fix(deps): resolve npm audit vulnerabilities

[LironTTG]

Summary

• updates npm dependency resolutions to clear audit findings, including patched tar-related transitive packages
• pins desktop/web React Router DOM resolution and overrides react-router to the patched version
• adds missing desktop use-effect-event dependency exposed by the regenerated tree

Verification

• npm audit: found 0 vulnerabilities
• security_scan.sh npm section: critical:0 high:0 moderate:0 low:0
• npm run typecheck --workspace apps/desktop
• npm run typecheck --workspace web
• npm run build --workspace web

[teknium1]

Thanks for addressing the audit findings. Two blockers need correction before this dependency update is safe to salvage.

Problems

• package.json:49 overrides every react-router resolution to root 8.3.0, while this PR keeps react-router-dom@7.18.1. The published react-router-dom@7.18.1 manifest requires react-router exactly 7.18.1; published react-router@8.3.0 also requires Node >=22.22.0, while the root supports Node >=20.0.0 (package.json:46).
• The regenerated package-lock.json removes Linux, Windows, and Darwin @esbuild/* entries. Current main commit 745d1383 restored these cross-platform entries specifically because pruning them breaks Linux/Windows installs.

Suggested changes

• Keep React Router package versions compatible, rather than forcing react-router@8.3.0 beneath react-router-dom@7.18.1.
• Rebuild the remediation from current main's lockfile and preserve the cross-platform esbuild entries restored in 745d1383.

Automated hermes-sweeper review.

[teknium1]

react-router-dom@7.18.1 depends on react-router exactly 7.18.1, but this override forces its dependency to 8.3.0. The forced package also requires Node >=22.22.0 while this repository supports Node >=20. Please retain a v7-compatible resolution or make a complete, separately validated v8 migration.