chore(deps): Remove unused dependencies and update vulnerable ones

[renato-freis]

Summary

Closes the Dependabot alerts on main: 19 alerts, 2 of them critical.

Most came from dependencies the code never used, so they are removed rather than bumped. An unused dependency is attack surface with no benefit, and updating one only defers the question to the next advisory.

Infrastructure: 16 vulnerabilities (2 critical) to 0

The package had no test files at all, yet carried vitest and @vitest/coverage-v8. Those held both critical advisories (Vitest UI server arbitrary file read and execute) and pulled a vulnerable vite. CI never ran the infrastructure test script, so removing it changes no pipeline behavior.

It also declared dependencies that are never imported:

Removed	Why
@vitest/coverage-v8, vitest	no test files; source of both criticals
@aws-sdk/client-cloudwatch-logs, @aws-sdk/client-dynamodb, @aws-sdk/lib-dynamodb	not imported; the Lambdas are Python
fast-xml-parser	not imported
scte35	not imported
fast-check	no property tests here
husky, lint-staged	no .husky directory, hooks never installed

The scte35 entry was the least obvious. The only matches in the CDK sources are the name of the Python Lambda layer:

lib/stacks/api-stack.ts:159:  const scte35Layer = buildPythonLayer(
lib/stacks/api-stack.ts:162:    path.join(__dirname, '../../../backend/layers/scte35'),

No import ... from 'scte35' exists, and that unused entry was what pulled inquirer and the vulnerable tmp.

What remains: source-map-support, which bin/pois-reference-server.ts registers, plus the CDK, TypeScript, ESLint and Prettier toolchain.

Frontend: 14 vulnerabilities to 2

scte35 is genuinely used by the SCTE-35 decoder, so it moves to 0.7.0, which replaces the transitive inquirer carrying the tmp path traversal. Verified against real payloads that every field the decoder reads is unchanged:

time_signal + descriptor: spliceCommandType=6, descriptors[0].segmentationTypeId=53
splice_insert:            spliceCommandType=5, spliceEventId/outOfNetworkIndicator/durationFlag present

Toolchain updates shared with infrastructure: @typescript-eslint 6 to 8, clearing five high advisories plus minimatch, and vite 5 to 8 with @vitejs/plugin-react 6, clearing the vite path traversal and the esbuild dev-server advisory. Node requirements of vite 8 (^20.19.0 || >=22.12.0) are satisfied by the repo's Node 20 baseline and by CI.

The stricter no-unused-vars default in @typescript-eslint 8 flagged two unused catch bindings in authSlice.ts; they are now optional catch bindings, which is what the code meant.

Deliberately not included

Two moderate advisories remain, both in react-router. The only fix is react-router-dom 7, a major upgrade of a runtime dependency, which deserves its own PR with a smoke test against a deployment rather than riding along in a dependency cleanup.

Neither advisory applies to this application as written:

• Arbitrary constructor injection via deserializeErrors() in SSR hydration: this is a client-only SPA with no SSR.
• Open redirect via backslash in <Link> and useNavigate: navigation targets are static internal routes, never user-controlled input.

Testing

• infrastructure: npm run lint, npm run build, npx cdk synth (all five stacks)
• frontend: npx tsc --noEmit, npm run lint, npm run build
• scte35 0.7.0 exercised against two real base64 payloads
• backend untouched, suite remains at 190 passing
• npm audit: infrastructure 0, frontend 2 moderate (react-router only)