ci: fix eslint 10 peer conflict + click PYSEC-2026-2132 (run #30854734500)

[Sbussiso]

CI fix for run #30854734500 (PR #75)

Run #30854734500 on dependabot/npm_and_yarn/frontend/eslint/js-10.0.1 failed two jobs independently. This branch fixes both.

1. Frontend npm ci — ERESOLVE peer conflict

Dependabot bumped @eslint/js 9.39.4 → 10.0.1, whose peerOptional is eslint ^10.0.0. But eslint was still pinned at ^9.39.4, so npm ci (strict) refused the conflicting peer dep:

npm error ERESOLVE could not resolve
npm error While resolving: @eslint/js@10.0.1
npm error Found: eslint@9.39.4
npm error Could not resolve dependency:
npm error   peerOptional eslint@"^10.0.0" from @eslint/js@10.0.1

Fix: bump eslint ^9.39.4 → ^10.0.0 in frontend/package.json and regenerate the lockfile. eslint-plugin-react-hooks (^7.1.1) and eslint-plugin-react-refresh (^0.5.3) both already accept eslint ^10 in their peer ranges. Resolves eslint@10.8.0 + @eslint/js@10.0.1.

2. Backend pip-audit --strict — PYSEC-2026-2132 in click

click 8.3.1 (transitive via uvicorn's CLI runner) has advisory PYSEC-2026-2132, fixed in 8.3.3. pip-audit --strict flagged it and failed the deploy:

Found 1 known vulnerability in 1 package
Name  Version ID              Fix Versions
----- ------- --------------- ------------
click 8.3.1   PYSEC-2026-2132 8.3.3

Fix: follow the existing constraint-dependencies pattern in backend/pyproject.toml — add "click>=8.3.3" and regenerate uv.lock (resolves click 8.4.2). Remove the constraint once uvicorn's own pin clears click 8.3.3.

Local verification (matches CI steps)

Step	Result
frontend: npm ci	✅ exit 0 (peer conflict resolved)
frontend: npm test (vitest)	✅ 85 passed (85)
frontend: npm run build (vite)	✅ built in 245ms
backend: uv run pip-audit --strict	✅ No known vulnerabilities found

⚠️ Not addressed here (pre-existing on master)

npm audit --audit-level=high --omit=dev also reports GHSA-qwww-vcr4-c8h2 (react-router CSRF, high). This advisory was published after the last green Test & Deploy on master (run 28823209746, 2026-07-06) and affects master too — it is not caused by PR #75. Its only fix is a breaking downgrade (react-router-dom 7.18.2 → 7.11.0) that belongs in its own change. Note: this run's frontend job failed at npm ci before reaching the npm audit step, so this advisory did not contribute to run #30854734500's failure.

---

Draft until CI confirms green on this branch.