[ewlarson]

The default branch has 180 open Dependabot alerts across 53 npm packages. This updates the dependency tree so no installed version matches any of those alerts' vulnerable ranges, including nested dependencies. Alerts should close after this PR is merged and GitHub rescans the default branch.

• Update React Router, AppSignal/OpenTelemetry, Vite, YAML/cookie utilities, and vulnerable transitive packages; raise security floors and retain targeted overrides where upstream dependency ranges lag.
• Upgrade Vitest and its UI/coverage packages to 4.1.12, Happy DOM to 21.0.4, and Pa11y CI to 5. Migrate worker configuration and test mocks, and declare the supported Node runtimes.
• Align Luma's Loaders.gl dependencies on 4.5.4 and remove the obsolete optional texture-compressor/image-size chain. New Puppeteer tooling also removes unpatched extract-zip.
• Add API transport, theme persistence, search-input, and projection regression coverage to preserve the existing 80% coverage thresholds under Vitest 4's more accurate coverage calculation.

Validation on Node 22.22.0:

• Clean npm ci succeeds.
• Checked all 180 captured GitHub alert ranges against every matching package instance in package-lock.json: zero affected instances.
• npm run lint -- --max-warnings=0, npm run typecheck, and npm run build pass.
• npm run test:ci: 959 tests pass across 79 files; statements 80.28%, lines 82.04%.
• Pa11y/Puppeteer browser smoke test against a temporary local accessible page: zero issues.
• Changed-file Prettier check and git diff --check pass. Repository-wide npm run format:check still reports 14 unchanged files with formatting issues.

Remaining upstream issue: npm audit reports six low-severity package findings, all deriving from the separate unpatched deepmerge advisory GHSA-gcqx-w48m-w2h4 through Mirador and build tooling. This advisory was not among the 180 open repository alerts. There are no moderate, high, or critical npm audit findings. The unresolved advisory is documented rather than suppressed or hidden by an unsafe downgrade.