chore(deps): aggregate weekly Dependabot batch (api, ui, docs, ci)

[agjs]

Summary

• Aggregates 24 Dependabot PRs (chore(ci): bump opentofu/setup-opentofu from 2.0.1 to 2.0.2 #248–chore(deps)(deps-dev): bump @eslint-community/eslint-plugin-eslint-comments from 4.7.1 to 4.7.2 in /apps/ui #271) into one weekly batch across api, ui, docs, and CI. Lockfiles regenerated per app; all three app merge bars pass locally.
• Includes two major docs bumps — astro 6.4.8 → 7.0.3 and @astrojs/react 5.0.7 → 6.0.0 — validated together via docs build:ci (they resolve cleanly and the site builds; the individual chore(deps)(deps): bump @astrojs/react from 5.0.7 to 6.0.0 in /apps/docs #260 linkcheck failure was the astrojs-react major landing without the astro major).
• Carries the necessary side-effects of the tooling bumps: prettier 3.9.1 reformatting (collapses short one-member-per-line unions — 14 style-only files) and a fix for a latent semgrep false-positive in apps/api/bunfig.toml surfaced by this batch (details below).

Dependency bumps

api — pg 8.21.0→8.22.0 · @anthropic-ai/sdk 0.105.0→0.106.0 · openai 6.44.0→6.45.0 · @sentry/bun 10.59.0→10.62.0 · resend 6.14.0→6.16.0 · stripe 22.2.2→22.3.0 · bullmq 5.79.1→5.79.2 · knip 6.16.1→6.23.0

ui — @sentry/react 10.59.0→10.62.0 · i18next 26.3.1→26.3.3 · lucide-react 1.21.0→1.22.0 · @tanstack/react-query(+devtools) 5.101.0→5.101.2 · @playwright/test 1.61.0→1.61.1 · @eslint-community/eslint-plugin-eslint-comments 4.7.1→4.7.2 · knip 6.16.1→6.23.0

docs — astro 6.4.8→7.0.3 · @astrojs/react 5.0.7→6.0.0 · wrangler 4.103.0→4.105.0 · @axe-core/cli 4.11.3→4.12.1

lint tooling (lockstep api + ui) — eslint 10.5.0→10.6.0 · typescript-eslint 8.61.1→8.62.0 · eslint-plugin-unicorn 68.0.0→69.0.0 · prettier 3.8.4→3.9.1

ci — docker/login-action v4.2.0→v4.4.0 · docker/build-push-action v7.2.0→v7.3.0 · docker/setup-buildx-action v4.1.0→v4.2.0 · opentofu/setup-opentofu v2.0.1→v2.0.2

bunfig semgrep fix

apps/api/bunfig.toml's header comment contained the literal [install] token. Semgrep's generic-mode bun-missing-minimum-release-age rule (from p/owasp-top-ten) has no TOML parser and read that comment as a second, empty install table — reporting minimumReleaseAge missing even though the real table sets it to 604800. ui/docs have no such header comment, so only api tripped. It only surfaced now because this batch reformats files under apps/api/src/, which is what gates the SAST scan (dependency-only batches never touch src/). Reworded the comment to drop the token; no install-behavior change.

Test plan

• bun run check per app (typecheck + lint + lint:meta + knip) — clean for api, ui, docs
• cd apps/api && bun run validate — check + 1188 pass / 0 fail (against the live dev stack)
• cd apps/ui && bun run validate — check + test:ci + build + size:check all pass
• cd apps/docs && bun run build:ci — passes with astro 7 + @astrojs/react 6
• Full pre-push gate (gitleaks + semgrep + osv-scanner + Playwright smoke + per-app validates + infra-compose config matrix)

App merge bars

Area	Command
API	cd apps/api && bun run validate
UI	cd apps/ui && bun run validate
Docs	cd apps/docs && bun run build:ci
Repo drift	bun run check (from repo root)

Conventions

• No any, no blind as, no ! — no production source logic changed (only version pins, mechanical prettier reformat, and a bunfig comment)
• No new env vars
• No behavior changed — tests unchanged, all green

Closes #248, #249, #250, #251, #252, #253, #254, #255, #256, #257, #258, #259, #260, #261, #262, #263, #264, #265, #266, #267, #268, #269, #270, #271