chore(deps): refresh project dependencies

[Wangnov]

Summary

• consolidate the open Dependabot upgrades across the root app, website, download worker, Rust crates, and GitHub Actions
• move CI/release jobs to Node.js 24 because @testing-library/jest-dom@7 requires Node.js 22+
• refresh compatible Cargo lockfiles and update the standalone Windows engine to windows@0.62.2
• update pinned workflow actions to their current immutable SHAs

Compatibility holds

These are intentionally not upgraded:

• typescript@7.0.2: blocked by typescript-eslint@8.65.0 peer range <6.1.0
• eslint@10 and @eslint/js@10: blocked by eslint-plugin-jsx-a11y@6.10.2, whose peer range currently ends at ESLint 9
• root webview2-com@0.38.2 and windows-core@0.61.2: pinned to the current Tauri/Wry ABI; the standalone Windows engine was upgraded independently

Validation

• codex review --uncommitted: no actionable findings
• root: check, lint, 284 tests, production build, npm audit
• website: production build
• Cloudflare worker: 9 tests
• Rust: clippy with warnings denied, all four test suites (24 + 42 + 82 + 128 tests)
• standalone Windows engine: x86_64 and ARM64 Windows target checks
• Node.js 24: TypeScript check, Vite build, and 284 tests
• cargo audit: no vulnerabilities; existing unmaintained GTK/Tauri advisories remain informational

Supersedes Dependabot PRs #227, #228, #229, #230, #232, #233, #234, #235, and #236. PR #231 is intentionally superseded without adopting its incompatible ESLint 10 upgrade.