Move to the fixed crypto stack and patched dependencies; run quality CI on hosted runners (#47)

- Move backend and root transitive deps to patched versions
- Upgrade web to react-router 7.18 and patched vitest/dompurify
- Move the sign app to vite 6.4.3
- Depend on the fixed crypto stack in web, sign and backend
- sign: typecheck the shared code it compiles
- ci: run the quality jobs on GitHub-hosted runners, and build sign
- Move to @pezkuwi/api 16.5.39
- ci: run CodeQL for JavaScript/TypeScript on a GitHub-hosted runner

sign/src/api-augment.d.ts

@@ -0,0 +1,3 @@
+// Types only: gives api.query/api.tx/api.events their chain-specific shapes, as
+// web/src/main.tsx does with a runtime import. Nothing here reaches the bundle.
+import '@pezkuwi/api-augment';