fix(security): update react-router to patched v7 (CVEs)

[birme]

Summary

• Bumped react-router and react-router-dom from 7.13.1 to 7.18.3 (range ^7.18.3 for both, kept version-aligned).
• Addresses advisories GHSA-49rj-9fvp-4h2h (8.1), GHSA-8646-j5j9-6r62 (8.0), GHSA-f22v-gfqf-p8f3 (7.5). npm audit now reports zero react-router advisories at any level.
• Stayed within React Router v7 (latest patched v7 is 7.18.3; latest dist-tag is now v8 major — intentionally not taken).
• Dual-package check: no nested divergent copies — both node_modules/react-router-dom/node_modules/react-router and node_modules/react-router/node_modules/react-router-dom are none (OK).

Test plan

• Tests pass (npm test) — 18 files / 147 tests
• TypeScript compiles (npm run typecheck)
• Lint clean (npm run lint)
• react-router / react-router-dom aligned, no nested copy
• npm audit --audit-level=high clear for react-router

Closes #647

🤖 Generated with Claude Code

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com