Move to react-router 7.18 (#76)

Every 6.x release is inside both open advisories, so no 6.x update closes
them: GHSA-wrjc-x8rr-h8h6 (open redirect via a backslash in <Link> and
useNavigate) and GHSA-337j-9hxr-rhxg (SSR hydration; not reachable here,
this is a client-only HashRouter app). 7.18 in library mode keeps every API
the app imports (Routes, Route, Link, NavLink, Navigate, useLocation,
useParams, HashRouter, MemoryRouter) and bundles @remix-run/router.

The one behaviour v7 changes, relative links under splat routes, does not
occur: no route path ends in '*', tab links are absolute (basePath) and the
top level picks the page from location.pathname.

Measured: 17 routes opened in Chromium against the live 6.x build and this
build give the same URL, active tab, tab count and tab-click target, with no
page errors. Tests 89/89, lint and type check green.

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

packages/react-components/package.json

@@ -41,8 +41,8 @@
     "react-dropzone": "^14.2.3",
     "react-i18next": "^13.5.0",
     "react-markdown": "^9.0.1",
-    "react-router": "^6.21.0",
-    "react-router-dom": "^6.21.0",
+    "react-router": "^7.18.0",
+    "react-router-dom": "^7.18.0",
     "react-tooltip": "^4.5.1",
     "rehype-raw": "^7.0.0",
     "semantic-ui-css": "^2.5.0",