chore(deps): update pinned dependencies

Bumps the exact-pinned deps, which caret ranges never pick up:
turbo, @playwright/test, @sentry/vite-plugin, vite-plugin-compression2,
react-icons, @base-ui/react, electron-builder, and the ts-essentials /
rimraf catalog entries. Plus dotenv ^16 -> ^17 (one consumer, `import
'dotenv/config'`) and wait-on ^7 -> ^9 (devDep, one CLI call).

No CI change needed for playwright: the workflow already derives its
browser cache key from `pnpm ls @playwright/test`.

Deliberately does NOT run a blanket `pnpm update -r`. Refreshing caret
drift pulls @types/express-serve-static-core 5.0.6 -> 5.1.3, which widens
`req.params` values to `string | string[]` and fails typecheck in 39
places across 8 routers. The widening is correct — express 5 can produce
array params — but adopting it is a source change of its own, and pnpm 11
cannot pin around it (overrides in package.json are silently ignored, and
the pnpm-workspace.yaml equivalent does not re-resolve).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NWs1vf42msmoJ21ABvQMpm

apps/server/package.json

@@ -10,7 +10,7 @@
     "cookie": "1.0.2",
     "cookie-parser": "1.4.7",
     "cors": "2.8.6",
-    "dotenv": "^16.0.1",
+    "dotenv": "^17.0.0",
     "express": "5.2.1",
     "express-static-gzip": "3.0.1",
     "express-validator": "7.3.2",