chore(deps): bump react-router and react-router-dom in /apps/frontend

[dependabot]

Bumps react-router to 7.18.2 and updates ancestor dependency react-router-dom. These dependencies need to be updated together.

Updates react-router from 7.18.1 to 7.18.2

Release notes

Sourced from react-router's releases.

v7.18.2

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7182

Changelog

Sourced from react-router's changelog.

v7.18.2

Patch Changes

• Harden RSC CSRF codepaths. (#15353)

Commits

• 69a653e Release v7.18.2 (#15354)
• 8ebd5df Harden RSC CSRF codepaths (backport of #15311) (#15353)
• See full diff in compare view

Updates react-router-dom from 7.18.1 to 7.18.2

Changelog

Sourced from react-router-dom's changelog.

v7.18.2

Patch Changes

• Updated dependencies:
  • react-router@7.18.2

Commits

• 69a653e Release v7.18.2 (#15354)
• See full diff in compare view

[parthrohit22]

Root-caused: this bump is correct, the gate blocking it was stale.

7.18.2 is the backported patch for GHSA-qwww-vcr4-c8h2 (advisory API: react-router >=7.12.0 <7.18.2, first_patched 7.18.2). PARTHA's dependency-audit policy still carried an acceptance for 7.18.1, so bumping past it trips the stale-acknowledgement check — the audit refuses the bump precisely because the bump fixes the advisory the acceptance was for.

Opened #267 to fix it properly: it retires the exception and includes this 7.18.1 → 7.18.2 bump in the same commit, because neither half is valid alone (retiring alone leaves an unpatched high-severity runtime advisory; bumping alone is what is red here). It also decouples the policy tests from the shipped entry so retiring an exception stops breaking five tests.

This PR becomes redundant once #267 lands — its change is contained there.

[dependabot]

Looks like these dependencies are up-to-date now, so this is no longer needed.