Move to the fixed crypto stack and patched dependencies; run quality CI on hosted runners (#47)

- Move backend and root transitive deps to patched versions
- Upgrade web to react-router 7.18 and patched vitest/dompurify
- Move the sign app to vite 6.4.3
- Depend on the fixed crypto stack in web, sign and backend
- sign: typecheck the shared code it compiles
- ci: run the quality jobs on GitHub-hosted runners, and build sign
- Move to @pezkuwi/api 16.5.39
- ci: run CodeQL for JavaScript/TypeScript on a GitHub-hosted runner

sign/tsconfig.app.json

@@ -24,9 +24,10 @@
     "paths": {
       "@/*": ["./src/*"],
       "@pezkuwi/lib": ["../shared/lib"],
-      "@pezkuwi/lib/*": ["../shared/lib/*"]
+      "@pezkuwi/lib/*": ["../shared/lib/*"],
+      "@pezkuwi/*": ["./node_modules/@pezkuwi/*"]
     },
-    "types": ["vite/client"]
+    "types": ["vite/client", "node"]
   },
   "include": ["src"]
 }