chore(deps): update pinned dependencies

Bumps the exact-pinned deps, which caret ranges never pick up:
turbo, @playwright/test, @sentry/vite-plugin, vite-plugin-compression2,
react-icons, @base-ui/react, electron-builder, and the ts-essentials /
rimraf catalog entries. Plus dotenv ^16 -> ^17 (one consumer, `import
'dotenv/config'`) and wait-on ^7 -> ^9 (devDep, one CLI call).

No CI change needed for playwright: the workflow already derives its
browser cache key from `pnpm ls @playwright/test`.

Deliberately does NOT run a blanket `pnpm update -r`. Refreshing caret
drift pulls @types/express-serve-static-core 5.0.6 -> 5.1.3, which widens
`req.params` values to `string | string[]` and fails typecheck in 39
places across 8 routers. The widening is correct — express 5 can produce
array params — but adopting it is a source change of its own, and pnpm 11
cannot pin around it (overrides in package.json are silently ignored, and
the pnpm-workspace.yaml equivalent does not re-resolve).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NWs1vf42msmoJ21ABvQMpm

apps/client/package.json

@@ -4,7 +4,7 @@
   "private": true,
   "type": "module",
   "dependencies": {
-    "@base-ui/react": "1.6.0",
+    "@base-ui/react": "1.7.0",
     "@codemirror/commands": "^6.0.0",
     "@codemirror/lang-css": "^6.0.0",
     "@codemirror/state": "^6.0.0",
@@ -29,7 +29,7 @@
     "react-dom": "^19.2.7",
     "react-fast-compare": "^3.2.2",
     "react-hook-form": "^7.80.0",
-    "react-icons": "5.6.0",
+    "react-icons": "5.7.0",
     "react-router": "^8.0.1",
     "react-virtuoso": "^4.18.7",
     "zustand": "^5.0.14"
@@ -60,7 +60,7 @@
     ]
   },
   "devDependencies": {
-    "@sentry/vite-plugin": "5.1.1",
+    "@sentry/vite-plugin": "5.4.0",
     "@types/node": "catalog:",
     "@types/qrcode": "^1.5.6",
     "@types/react": "^19.1.12",
@@ -74,7 +74,7 @@
     "sass": "^1.57.1",
     "typescript": "catalog:",
     "vite": "8.2.1",
-    "vite-plugin-compression2": "2.5.1",
+    "vite-plugin-compression2": "2.5.3",
     "vite-plugin-svgr": "4.5.0",
     "vitest": "catalog:"
   }

apps/electron/package.json

@@ -14,8 +14,8 @@
   "main": "src/main.js",
   "devDependencies": {
     "electron": "38.2.1",
-    "electron-builder": "26.9.1",
-    "wait-on": "^7.2.0"
+    "electron-builder": "26.15.3",
+    "wait-on": "^9.0.0"
   },
   "scripts": {
     "dev:electron": "wait-on http://localhost:3000 && cross-env NODE_ENV=development electron .",

apps/server/package.json

@@ -10,7 +10,7 @@
     "cookie": "1.0.2",
     "cookie-parser": "1.4.7",
     "cors": "2.8.6",
-    "dotenv": "^16.0.1",
+    "dotenv": "^17.0.0",
     "express": "5.2.1",
     "express-static-gzip": "3.0.1",
     "express-validator": "7.3.2",