fix(deps): migrate off abandoned react-router-dom, fix eslint's own brace-expansion

Two real, forward-compatible fixes for npm audit's high-severity
advisories (not the downgrades npm audit fix --force offers):

- react-router (GHSA-qwww-vcr4-c8h2, RSC CSRF bypass): react-router-dom
  is frozen at 7.18.1, pinning the vulnerable react-router@7.18.1 -- no
  newer react-router-dom release exists pointing at the fixed line.
  react-router itself has shipped the real fix at 8.3.0. Migrated the 9
  files importing from react-router-dom (all using plain
  createBrowserRouter/RouterProvider/useLocation/useNavigate/Outlet, no
  RSC anywhere) to import from react-router directly instead.

- brace-expansion/minimatch (GHSA-mh99-v99m-4gvg): fixed for eslint's
  own dependency chain (minimatch@10.2.5, used by eslint itself,
  storybook, typescript-eslint, swagger-client) via a scoped
  "minimatch@^10" override forcing brace-expansion to the now-published
  5.0.8 patch -- within the range minimatch@10.2.5 already declares
  wanting (^5.0.5), so this isn't a version-pin workaround, just
  unblocking a patch release npm's resolver hadn't picked up.

One advisory remains genuinely unfixable from our side:
eslint-plugin-jsx-a11y pins minimatch@^3.1.2 (old major, never
patched); forcing it to the 10.x line via override breaks npm's own
dependency-tree validation (a real incompatibility, not just an npm
quirk), so this needs an eslint-plugin-jsx-a11y release bumping its own
minimatch. Lint-time only, no untrusted input reaches it -- ci.yml's
Audit step comment updated to reflect the new, smaller remaining scope.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

frontend/package.json

@@ -44,7 +44,7 @@
     "react-dom": "^19.2.8",
     "react-hook-form": "^7.82.0",
     "react-i18next": "^17.0.10",
-    "react-router-dom": "^7.18.1",
+    "react-router": "^8.3.0",
     "swagger-ui-react": "^5.32.11",
     "uplot": "^1.6.32",
     "zod": "^4.4.3"
@@ -61,6 +61,7 @@
     "@types/react-dom": "^19.2.3",
     "@types/swagger-ui-react": "^5.18.0",
     "@vitejs/plugin-react": "^6.0.4",
+    "@vitest/browser-playwright": "4.1.10",
     "@vitest/coverage-v8": "^4.1.10",
     "eslint": "^10.7.0",
     "eslint-plugin-jsx-a11y": "^6.10.2",
@@ -70,18 +71,20 @@
     "jsdom": "^29.1.1",
     "lint-staged": "^17.1.1",
     "msw": "^2.15.0",
+    "playwright": "^1.61.1",
     "storybook": "^10.5.3",
     "typescript": "^6.0.3",
     "typescript-eslint": "^8.65.0",
     "vite": "8.1.5",
-    "vitest": "^4.1.10",
-    "@vitest/browser-playwright": "4.1.10",
-    "playwright": "^1.61.1"
+    "vitest": "^4.1.10"
   },
   "overrides": {
     "eslint-plugin-jsx-a11y": {
       "eslint": "$eslint"
     },
+    "minimatch@^10": {
+      "brace-expansion": "^5.0.8"
+    },
     "dompurify": "^3.4.11",
     "react-copy-to-clipboard": "^5.1.1",
     "react-inspector": "^9.0.0",