[Misc] Migrate ornn-web from react-router-dom 7 to react-router 8

[chronoai-shining]

Background

react-router advisory GHSA-qwww-vcr4-c8h2 (high, "RSC Mode CSRF Bypass Allows Action Execution Before 400 Response") affects >=7.12.0 <8.3.0. ornn-web is on react-router@^7.17.0 + react-router-dom@^7.18.0.

The advisory is not reachable here — verified in #1217 and documented in the audit job comment:

• RSC mode requires the @react-router/* server packages; none appear in bun.lock.
• ornn-web is a static Vite SPA (vite build, no SSR target).
• The router is built with createBrowserRouter + RouterProvider (ornn-web/src/App.tsx:258), so the vulnerable server-action path is never constructed.

It is therefore --ignored in CI rather than blocking. This issue is about removing that ignore properly.

Why it is not a one-line bump

The fixed version is react-router@8.3.0, but react-router-dom was not carried to 8.x — it is frozen at 7.18.2. React Router 8 consolidates everything into the react-router package. Every ornn-web import currently reads:

import { ... } from "react-router-dom";

across App.tsx, layouts, guards, cards, navbar, and more. Adopting 8.x means moving all of them to react-router and re-verifying the data-router setup, guards, and lazy routes.

That is a real migration with real regression surface, which is why it was deliberately not bundled into #1217 (an OpenAPI-contract fix landing immediately before a release).

Definition of Done

• react-router on 8.3.0+, react-router-dom dependency removed.
• All react-router-dom imports migrated to react-router.
• Route guards, lazy routes, and the data-router config verified — full ornn-web suite green.
• --ignore=GHSA-qwww-vcr4-c8h2 removed from the audit job in .github/workflows/ci.yml, and the justification comment deleted with it.
• Changeset included.

Related to #1218 (the audit job going green). Related to #1217.