chore: Resolve npm audit warnings (includes major bumps)

[antobinary]

merge after #128

What does this PR do?

Refreshes the dependency tree: moves three dev-tooling packages onto their current supported major lines, removes one that is no longer needed, and declares the project's Node requirement.

Change	Notes
@typescript-eslint/{eslint-plugin,parser} ^6.2.0 → ^8.66.0	The v6 line is closed — 6.21.0 is its final release — and it pins several transitive dependencies to versions that are no longer maintained. v8 is the current line and works with the ESLint 8.57.1 already in the tree, so no ESLint change is needed. Lint output is unchanged.
copy-webpack-plugin ^12.0.2 → ^14.0.0	Current major. Used only to copy manifest.json and the locale files into dist/; behaviour verified unchanged (see below).
webpack-dev-server ^4.15.1 → ^6.0.0	Current major. Uses ws for the client transport instead of sockjs, and needs a small config migration (below). Dev-only — not used by build-bundle.
removed watch	Its only consumer was lint:watch, which shelled out to watch 'yarn lint' — invoking yarn in an npm project. eslint-watch was already a devDependency, so lint:watch now runs esw directly.
added engines: { "node": ">=22.15.0" }	See below.
remainder	Lockfile-only refresh of transitive dependencies; no API surface touched.

Config migration. webpack-dev-server v5 removed onBeforeSetupMiddleware, which webpack.config.js used to serve manifest.json from the project root. It is now registered through setupMiddlewares, still on devServer.app, so middleware ordering — and therefore response headers — behave exactly as before.

Why declare engines. webpack-dev-server@6 requires Node ≥ 22.15.0. Without an engines field that requirement surfaces only as an EBADENGINE warning from a transitive package at install time, which is easy to miss and hard to attribute to anything in particular. Declaring it on the project states the supported floor once, in the place people look for it, and matches .nvmrc (22, which resolves to the latest 22.x). It is the strictest requirement in the tree — building the plugin itself needs only Node ≥ 20.9.

Closes Issue(s)

Closes #

Motivation

The dependency tree had drifted well behind current releases, with a number of individual bump branches open against the repo. Handling them together means the toolchain gets exercised end to end once — build, unit tests, e2e, dev server — instead of validating each bump in isolation. Three of the changes are majors that needed a deliberate decision, and one of them required a config migration, which is easier to review as a single unit than spread across separate PRs.

More

Verification — these upgrades touch the build, so the output was checked directly rather than assumed:

• Production bundle is byte-identical to the pre-upgrade baseline (md5 e08b65594d2119d5f62a1ea368ab26ca), i.e. the copy-webpack-plugin major did not alter build output.
• dist/ still contains manifest.json and all 7 locale files.
• npm start exercised manually against the migrated devServer config: /manifest.json → 200 with correct JSON, bundle → 200, /locales/en.json → 200.
• 64/64 unit tests, 16/16 Playwright e2e, npm run lint and tsc --noEmit clean, npm ci resolves.

Reviewer notes:

• webpack.config.js is the only non-manifest file changed.

• release-upload-assets.yml and release-publish-do-spaces.yml still pin node-version: 20.x. They continue to build fine — the build needs only ≥ 20.9, and webpack-dev-server is not used by build-bundle — but they will emit EBADENGINE warnings against the new floor. Switching them to node-version-file: '.nvmrc' (as the other four workflows already do) is left out to keep this PR to one thing.

• Added/updated documentation

[github-actions]

This pull request has conflicts ☹
Please resolve those so we can review the pull request.
Thanks.