chore(deps): clear Dependabot alerts — React 19, react-router 8, Vite 7

Bumps both frontend apps (site, admin-ui):
- vite 5.4 -> 7.3.6 (pulls esbuild 0.28, patched dev-server CVEs)
- @vitejs/plugin-react 4 -> 5 (babel 7.29.7)
- postcss 8.4 -> 8.5.25
- react-router-dom 6.27 -> react-router 8.3.0 (package renamed
  upstream in v8; imports swapped in src). Fixes the open-redirect
  advisories with no patched 6.x, plus the RSC CSRF advisory
  (GHSA-qwww-vcr4-c8h2) that only 8.3.0 patches.
- react/react-dom 18.3 -> 19.2 (required by react-router 8)

npm audit: 0 vulnerabilities in both apps. tsc + vite build clean.

DorkNet.Server/site/src/App.tsx

@@ -1,4 +1,4 @@
-import { Routes, Route, Navigate } from 'react-router-dom';
+import { Routes, Route, Navigate } from 'react-router';
 import { Header } from './components/Header';
 import { Home } from './pages/Home';
 import { Feed } from './pages/Feed';
@@ -43,6 +43,6 @@ export function App() {
 }
 
 // Small redirect shims so old #/p/123 / #/u/45 links keep working.
-import { useParams } from 'react-router-dom';
+import { useParams } from 'react-router';
 function RedirectPhoto()  { const { id } = useParams(); return <Navigate to={`/photo/${id}`}  replace />; }
 function RedirectPlayer() { const { id } = useParams(); return <Navigate to={`/players/${id}`} replace />; }