deps: consolidate the open dependency PRs into one toolchain upgrade

[jnnngs]

What and why

Sixteen Dependabot PRs were open against main, several of which could not land
on their own: Vitest 5 needs Vite 6+, ESLint 10 needs a react-hooks plugin that
does not exist below v7, and the Go and Node bumps left the Dockerfiles building
against toolchains older than the manifests now require. This branch takes all
sixteen together, resolves the interlocks, and fixes what the newer versions
broke, so there is one thing to review and one lockfile to regenerate.

Landed here — #486, #487 (Go), #485 (Actions), #438, #441, #471 (base images),
#442, #444 (e2e), #446, #447, #448, #450, #451, #452, #472 and the compatible
half of #488. They should auto-close when this merges.

Held back deliberately, both from #488 and #446:

• Tailwind 4. It redefines utilities the design system already leans on —
  shadow-sm, rounded-sm, ring, outline-none — and there are 191 uses of
  those across the app, so the upgrade is a silent visual change everywhere
  rather than a version bump. It needs its own PR with someone actually looking
  at the pages. Tailwind moves to 3.4.19 here instead.
• TypeScript 7. No typescript-eslint release supports it (8.70 still pins
  typescript <6.1.0), so taking it means an unsupported parser or
  --legacy-peer-deps. TypeScript 6 is the highest version inside that range and
  is what landed, in both frontend/ and e2e/.

Fixes the upgrades themselves required:

• Go 1.26 / Node 26. backend/Dockerfile still built on golang:1.25-alpine,
  which cannot compile a go 1.26.0 directive, and every workflow installed
  Node 20 (EOL since April 2026) while the frontend image moved to
  node:26-alpine — so CI was testing a tree the image did not build. Both are
  aligned, and the Go directive is pinned to 1.26.8 rather than 1.26.0,
  following the note in backend/go.mod about the directive being the stdlib
  floor.
• React 19. Needs react-leaflet 5 (react-leaflet 4 pins react ^18). Its
  useRef typings now return RefObject<T | null>, so the two hooks that take a
  ref widened their parameters, and EventScorecard uses ReactElement in place
  of the global JSX namespace React 19 removed.
• jsdom 30 makes window.location a live Location setter that coerces its
  argument to a URL string, so the two suites that swapped it with
  Object.assign now redefine the property. That was 14 failing tests.
• ESLint 10 forces eslint-plugin-react-hooks 7, which folds the React
  Compiler diagnostics into its recommended set — ~70 findings, each a
  behavioural refactor. Those six rules are switched off with a note naming them
  as follow-up work; rules-of-hooks and exhaustive-deps stay on, so the gate
  enforces exactly what it enforced before (verified against a probe file).
  react-refresh 0.5 flags all 85 exports of the route manifest, which is exempted
  per-file.
• lucide-react 1 drops every brand icon, so the Facebook share button gets an
  inline mark next to the X one already drawn there.
• TypeScript 6 no longer auto-includes @types/node, which the suites reading
  fixtures off disk relied on transitively; it is now an explicit devDependency
  with a types entry.
• e2e: ESLint 10 removed .eslintrc support entirely, so that suite moves to
  a flat config, and baseUrl is dropped (deprecated in TS 6; paths resolves
  from the tsconfig directory without it). The three findings the newer rules
  surfaced are fixed, not silenced.

npm audit on frontend/ goes from 8 findings to 2 — the runtime half
(--omit=dev, the hard gate) is clean, and what remains is the @capacitor/cli
→ tar advisory already written up in SECURITY.md. e2e/ is clean.

How you tested it

Everything below ran from a wiped node_modules and a regenerated lockfile
(npm ci), so the tree is the one a container build resolves:

• backend: make migrate-lint, make lint, make test (-race), make build
  — all pass on Go 1.26.8. govulncheck ./... reports no vulnerabilities.
• frontend: npm run check, npm run lint, npm test (59 files, 364 tests,
  all passing), npm run build.
• e2e: npm run typecheck, npm run lint.
• Checked the rebuilt service worker still carries the /demos/ navigation
  denylist and still precaches no .webm, since vite-plugin-pwa went 0.20 → 1.3.
• Verified each new base image tag resolves in its registry (golang:1.26-alpine,
  alpine:3.24, node:26-alpine, nginx-unprivileged:1.31-alpine). The image
  builds themselves are CI's docker job — there is no daemon in this environment.
• Confirmed rules-of-hooks and exhaustive-deps still fire under the new
  ESLint config by linting a deliberately broken component.

Not run: the Playwright suite (needs a live stack) and any on-device mobile
build.

Checklist

• cd backend && make lint && make test passes
• cd frontend && npm run check && npm run lint && npm test && npm run build passes
• Backend tests ran against a database (make dev first) — DB-backed tests skip silently without DB_HOST
• I read the relevant section of CLAUDE.md and followed its conventions
• No unrelated refactoring, renames or comment additions in this diff

If it applies

• Native change — the Android and iOS projects wrap a bundle built by a
  new Vite and a new React, and neither was run on a device or emulator here.
  Worth a real install before this ships.

Notes for reviewers

• The two deferrals above (Tailwind 4, TypeScript 7) are the parts of this that
  are a judgement call rather than a fact. Both are one-line reverts to take
  anyway if you would rather.
• The six disabled react-hooks/* compiler rules are the other judgement call.
  The findings are real — 47 set-state-in-effect and 19 refs — and worth
  working through, but not inside a dependency bump. frontend/eslint.config.js
  lists them so the follow-up has a starting point.
• docs, CLAUDE.md, README.md and CHANGELOG.md are updated for the new
  versions.
• Node 26 rather than 24 follows Dependabot's own proposal for the build image;
  if you would rather sit on the current LTS, changing it is one value in the
  Dockerfile and five in the workflows.

🤖 Generated with Claude Code

https://claude.ai/code/session_016Pji5g7ypeYALnrrcauLYK

---

Generated by Claude Code