app: patch vulnerable dev dependencies

Sweeps the build-time dependency tree, which is where most of what
`yarn audit` reports actually lives. This takes the frontend from 419
findings across 42 packages down to 16 across 9.

Most of it is lockfile-only. `yarn upgrade` does not re-resolve
transitive entries in yarn 1, so the affected entries were dropped from
yarn.lock and reinstalled, which picks the newest version each parent's
existing range already allows. That covers the four open dependabot PRs
(shell-quote, websocket-driver, @babel/core and
@babel/plugin-transform-modules-systemjs) along with @babel/helpers,
ajv, async, brace-expansion, form-data, glob, js-yaml, json5, nanoid,
terser and ws.

Re-resolving express to 4.22.2 pulls patched body-parser, cookie,
path-to-regexp and qs with it, and clears the stale minimatch 3.0.4 and
semver 7.0.0 pins at the same time.

browserslist and caniuse-lite had to move too. @babel/core 7.29 emits
'opera_mobile' as a compilation target and the pinned
@babel/helper-compilation-targets 7.17.7 rejects it, which broke the
production build until the whole toolchain was aligned.

storybook goes to 7.6.24 and webpack to 5.109.2, both direct
devDependencies pinned to vulnerable versions.

The `resolutions` additions are for packages whose parent pins a range
with no patched version in it. Each was verified against a build:

- svgo 2.8.3 removes the svgo 1.x subtree that @svgr/plugin-svgo drags
  in. react-scripts sets `svgo: false`, so that plugin never runs, and
  the production bundle is byte for byte identical with and without it.
- resolve-url-loader 5.0.0 is the only way to drop postcss 7. The
  emitted CSS is unchanged, same content hash.
- @tootallnate/once, esbuild, nth-check, serialize-javascript, tar and
  uuid are straightforward version forces.

What is left is either unfixable or would break the build:

- protoc-gen-js pulls got, http-cache-semantics, adm-zip and decompress
  through the unmaintained `download` package. decompress has no
  published fix. None of it runs outside `yarn protos`.
- webpack-dev-server 5 drops the onBeforeSetupMiddleware and
  onAfterSetupMiddleware hooks that react-scripts 5.0.1 calls directly,
  so forcing it would break `yarn start`.
- ip and lodash.pick have no patched version published.
- react-router needs v7, which is a separate migration.

app/package.json

@@ -57,13 +57,13 @@
     "styled-components": "5.1.1"
   },
   "devDependencies": {
-    "@storybook/addon-actions": "7.5.3",
-    "@storybook/addon-docs": "7.5.3",
-    "@storybook/addon-links": "7.5.3",
-    "@storybook/addons": "7.5.3",
-    "@storybook/preset-create-react-app": "7.5.3",
-    "@storybook/react": "7.5.3",
-    "@storybook/react-webpack5": "7.5.3",
+    "@storybook/addon-actions": "7.6.24",
+    "@storybook/addon-docs": "7.6.24",
+    "@storybook/addon-links": "7.6.24",
+    "@storybook/addons": "7.6.24",
+    "@storybook/preset-create-react-app": "7.6.24",
+    "@storybook/react": "7.6.24",
+    "@storybook/react-webpack5": "7.6.24",
     "@testing-library/jest-dom": "5.11.5",
     "@testing-library/react": "11.1.1",
     "@testing-library/user-event": "12.2.0",
@@ -93,15 +93,23 @@
     "protoc-gen-js": "3.21.2",
     "react-scripts": "^5.0.1",
     "sass": "1.43.4",
-    "storybook": "7.5.3",
+    "storybook": "7.6.24",
     "ts-protoc-gen": "0.15.0",
     "typescript": "4.9.5",
-    "webpack": "5.89.0"
+    "webpack": "5.109.2"
   },
   "resolutions": {
+    "@tootallnate/once": "2.0.1",
+    "esbuild": "0.25.12",
     "http-proxy-middleware": "2.0.10",
-    "strip-ansi": "6.0.1",
     "jackspeak": "2.1.1",
+    "nth-check": "2.1.1",
+    "resolve-url-loader": "5.0.0",
+    "serialize-javascript": "7.1.0",
+    "strip-ansi": "6.0.1",
+    "svgo": "2.8.3",
+    "tar": "7.5.22",
+    "uuid": "11.1.1",
     "wrap-ansi": "7.0.0"
   },
   "eslintConfig": {