Resolve all 30 Dependabot alerts (client): webpack 5 + jest 30 modernization

[rubenhensen]

What

Resolves all 30 open Dependabot alerts in the client (16 high, 10 moderate, 4 low). Every alert was a transitive npm dependency. Where possible these are fixed at the root (dependency removed/upgraded) rather than only pinned via overrides.

Package	Was	Now	How
webpack-dev-server	3.11	5.2.5	direct bump (clears its 4 source-code-theft alerts)
node-forge	0.10	gone	wds3 subtree removed
webpack-dev-middleware	3.7	7.4	via wds5
ip	1.1.9	gone	wds5 doesn't use it (no patched version exists)
elliptic	6.6.1	gone	webpack 5 drops auto node-polyfills (no patched version exists)
tar	6.2	gone	copy-webpack-plugin 12 dropped cacache
braces	2.3.2	3.0.3	jest 30 dropped sane → micromatch@3
postcss	7.0.39	8.5.x	removed unused stylelint + css-loader 6
serialize-javascript	4/5	7.0.5	override
uuid	3/8	11.1.1	override
@tootallnate/once	1.1.2	gone/2.x	override + jest 30

Why a migration was needed

elliptic and ip have no patched version (even latest is flagged), so the only fix is removing them from the tree — which requires webpack 5 (drops the node-polyfill crypto-browserify→elliptic chain) and webpack-dev-server 5 (drops ip). The webpack-dev-server alerts live in its own code and are only fixed in v5, which requires webpack 5. braces@2.3.2 is dragged in by jest 26's sane, so jest also had to move. The user approved major bumps for this.

Key changes

• webpack 4 → 5, webpack-dev-server 3 → 5, jest 26 → 30, copy-webpack-plugin 6 → 12, css-loader/style-loader/html-webpack-plugin/babel-loader bumped.
• Replaced abandoned awesome-typescript-loader with babel-loader + tsconfig-paths-webpack-plugin; removed react-hot-loader, write-file-webpack-plugin, clean-webpack-plugin, and the unused stylelint toolchain.
• Added resolve.fallback polyfills for browser libs (eventsource, vfile). crypto is intentionally not polyfilled so elliptic stays out of the tree.
• Pinned ajv@^8 to fix the eslint7/webpack5 ajv-keywords hoisting conflict.
• jest 30: babel-jest (drops ts-jest), explicit jsdom env, toBeCalled→toHaveBeenCalled, useFakeTimers({ advanceTimers: true }). Also fixed pre-existing stale geocode test mocks (geodata.nationaalgeoregister.nl → api.pdok.nl) and regenerated snapshots.

Verification

npm ci, npm run build, and npm test all pass locally (12 suites / 47 tests green; jest 30 also fixes the jest-worker crashes the suite hit under Node 26). CI builds the client via Dockerfile.prod (npm ci && npm run build).

Out of scope

npm audit still reports 19 moderates, all tracing to a single js-yaml advisory (GHSA-h67p-54hq-rp68) that has no patched version, pulled via eslint@7 and jest's coverage instrumenter. These were not in the Dependabot alert set; clearing them needs an eslint 9 migration — a sensible follow-up.