fix: migrate desktop routing to React Router 8.3.0

[jbg]

Summary

• replace the removed react-router-dom package with a direct react-router dependency and update all 18 desktop source/test references and router mocks
• raise the React and ReactDOM baseline, including the workspace overrides, from 19.2.4 to 19.2.8
• prepare imports on React Router 7.18.2, then upgrade the direct dependency to React Router 8.3.0 in a separate commit
• remove @types/react-router-dom and the now-unreferenced legacy @types/react-router lockfile entries

Scope

Goose Desktop remains on its existing declarative HashRouter/Routes/Route architecture. This does not change route hierarchy or navigation semantics, and it does not add Data Router, Framework Mode, RSC APIs, future flags, RouterProvider, or HydratedRouter.

React Router 8 removes react-router-dom, so the declarative routing APIs Goose already uses now come directly from react-router. React and ReactDOM move to 19.2.8 to satisfy React Router 8.3.0's >=19.2.7 peer requirement; Goose's Node ^24.10.0 target already satisfies the new >=22.22.0 engine requirement.

Security applicability

Repository inspection found no use of the unstable React Router RSC APIs affected by GHSA-qwww-vcr4-c8h2, so the vulnerable path was not reachable in Goose. Moving to 8.3.0 nevertheless removes the version-based advisory from the shipped desktop dependency graph.

Addresses #10964.

Verification

• pre-v8 checkpoint on direct react-router@7.18.2: pnpm run typecheck passed and pnpm run test:run passed (64 files, 602 tests)
• pnpm install --frozen-lockfile --lockfile-only --ignore-scripts from ui: passed
• pnpm --filter @aaif/goose-sdk run build: passed
• pnpm run lint:check from ui/desktop: passed, including TypeScript, ESLint, and i18n validation
• pnpm run test:run from ui/desktop: passed (64 files, 602 tests)
• pnpm --filter goose-app list react react-dom react-router --depth 1: resolved React 19.2.8, ReactDOM 19.2.8, and React Router 8.3.0
• tracked UI/lockfile searches: no react-router-dom, @types/react-router-dom, legacy @types/react-router, or unstable RSC API occurrences remain
• pnpm audit --prod: GHSA-qwww-vcr4-c8h2 is absent and there are no react-router findings; the audit is not otherwise clean and still reports 44 unrelated findings (11 high, 31 moderate, 2 low)
• pnpm run package: passed, including the Vite production renderer bundle and Electron Forge arm64 macOS package, validating the ESM-only production build path
• packaged GUI smoke attempt: blocked before renderer creation by the unrelated missing packaged Goose binary; startup diagnostics report neither Contents/Resources/bin/goose nor Contents/Resources/goose exists, so the route matrix could not be exercised in this environment
• cargo fmt --check: passed
• git diff --check: passed

The lockfile's large first-commit churn is the expected React 19.2.4 to 19.2.8 peer-context rewrite. The 8.3.0 commit is limited to React Router and its own cookie dependency change.