ACAS-963: Remove unused or lightly used npm packages

[brianbolt]

Summary

Removes 20 npm dependencies from package.json with no behavior change. Packages were either completely unused or minimally used (1–2 files) and replaceable with native Node.js 20 code.

• 12 removed (zero usage): archiver, bluebird, json2csv, lodash, marked, puppeteer, semver, style-loader, url-loader, yamljs, jasmine-jquery, backbone-validation
• 2 removed (built-in takes priority): assert (Node.js core wins), promise (native Promise identical)
• 1 replaced with fs.cp(): ncp — stable in Node 16+
• 2 inlined (~25 lines): flat, underscore-deep-extend — replaced with flatten and deepExtend functions in PrepareConfigFiles.coffee
• 1 inlined (factory function): temporary — replaced with makeTempFile() using fs/os in ServerUtilityFunctions.coffee and CreateLiveDesignLiveReportForACAS.coffee
• 1 replaced with async/await: async — async.forEachSeries rewritten in PrepareModuleConfJSON.coffee
• 1 inlined (one-liner): csv-stringify — single call site replaced with data.map((row) -> row.join(',')).join('\n')

Both the main repo and acas_custom_schrodinger/sources/ were checked. The custom modules only use csv-parse and underscore from this package.json, neither of which was touched.

Note: each was initially flagged as unused but has a live require() in PreferredBatchIdService.coffee — it was re-added and is a candidate for a follow-on refactor.

Test plan

• Docker build passes with all changes (acas-cleanup-final image built successfully)
• No remaining require() calls for any removed package (verified with corrected CoffeeScript-aware grep pattern)
• package-lock.json regenerated and consistent with package.json

Closes ACAS-963

🤖 Generated with Claude Code