sec(frontend): pin npm dependencies to exact versions (closes #425)

[cristim]

Summary

• Replaces all 29 caret (^) version ranges in frontend/package.json with the exact versions already recorded in package-lock.json.
• Eliminates the attack surface where npm install (rather than npm ci) resolves a newer minor/patch release that may carry unaudited CVEs.
• No functional change: every pinned version is the version currently installed; the lockfile is unchanged.

Test plan

• All 29 dependencies + devDependencies entries verified to match package-lock.json exactly (node script).
• npx tsc --noEmit -- no errors.
• npm test --coverage -- 65 suites, 2142 tests passed, 1 skipped.
• npm ci in a clean environment (disk full locally; CI will exercise this).

Summary by CodeRabbit

• Chores
  • Updated frontend tooling and library versions, including build, testing, linting, and TypeScript-related packages.
  • Upgraded the charting library to a newer release.
  • Locked package versions to exact values for more predictable installs and builds.

[cristim]

@coderabbitai review

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: f3ebd3cc-c5bf-49d4-b502-349f15e2b4ef

📥 Commits

Reviewing files that changed from the base of the PR and between 60526ce and 6f2d921.

📒 Files selected for processing (1)

• frontend/package.json

---

📝 Walkthrough

Walkthrough

This change updates frontend/package.json, bumping multiple devDependencies (Babel, TypeScript tooling, Jest, ESLint, Webpack stack, loaders/plugins, jsdom) and pinning them to exact version specifiers instead of caret ranges. The chart.js dependency version is also bumped.

Changes

Frontend dependency version updates

Layer / File(s)	Summary
Pin devDependencies and bump chart.js version frontend/package.json	DevDependencies are bumped and pinned to exact versions (removed caret ranges), and chart.js is bumped while qrcode is left unchanged.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Related issues: None specified

Related PRs: None specified

Suggested labels: dependencies, frontend

Suggested reviewers: None specified

🐰 A carrot-crunch, a version bump,
No caret left, just numbers plump,
Chart.js grows a whisker more,
Frontend deps now locked and sure.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely matches the main change: pinning frontend npm dependencies to exact versions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/425-wave19

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[cristim]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[cristim]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[cristim]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.