Refresh the Dashboard dependency baseline and retire resolved audit exceptions

[tiammomo]

Summary

The grouped Dashboard minor/patch update in Dependabot PR #32 fixes the react-router advisory, but the repository audit remains red because scripts/audit-dashboard.mjs still requires the temporary GHSA-qwww-vcr4-c8h2 exception to appear. A maintained replacement must update the supported Dashboard dependency baseline and remove only the now-resolved exception without weakening fail-closed auditing.

Actual behavior

On current main 14ea1f5 plus PR #32, npm ci and scripts/check-all.sh pass, including 453 Rust tests and 113 Dashboard tests, and cargo-audit reports no Rust vulnerability. node scripts/audit-dashboard.mjs fails with: react-router GHSA-qwww-vcr4-c8h2: stale exception is not present in the audit report.

Expected behavior

The current grouped Dashboard minor/patch baseline installs and passes repository checks, and the Dashboard audit passes because the resolved react-router exception is removed while unexpected advisories and future stale exceptions remain hard failures.

Steps to reproduce

Merge PR #32's head 0f144dd into current main 14ea1f5 in an isolated worktree; run npm --prefix dashboard ci --no-audit --no-fund, scripts/check-all.sh, cargo-audit audit --deny warnings --file Cargo.lock, then node scripts/audit-dashboard.mjs.

Environment

ModelPort main 14ea1f5; Dependabot PR #32 head 0f144dd; Node 24; npm lockfile install; cargo-audit 0.22.2.

Acceptance criteria

• Update only the grouped Dashboard minor/patch dependency baseline and generated lockfile; keep TypeScript 7 and @types/node 26 major upgrades out of scope; remove the resolved GHSA-qwww-vcr4-c8h2 audit exception without weakening unknown/stale-exception enforcement; npm ci, typecheck, lint, 113 Dashboard tests, production build, Rust checks, cargo audit, cargo deny, Dashboard audit, and CI pass; make no Provider, Runtime Adapter, API, route, database, credential, or local-inference-stack changes.