build(deps-dev): pin @babel/core to ^7.29.6 (fix Dependabot security_update_not_possible)

[Sbussiso]

Root cause

Dependabot security-update run #32779463077 (job 1539386011) concluded failure with security_update_not_possible for @babel/core:

• Advisory: @babel/core Arbitrary File Read via sourceMappingURL Comment — affects <= 7.29.0; earliest fixed version 7.29.6.
• @babel/core is pulled transitively: eslint-plugin-react-hooks@7.1.1 → @babel/helper-module-transforms@7.28.6 → @babel/core@7.29.0, with a ^7.24.4 edge from eslint-plugin-react-hooks itself.
• Dependabot's security resolver could find only one update path, and that path would have downgraded eslint-plugin-react-hooks from 7.1.1 → 5.2.0. Refusing to open a downgrade-as-fix PR, it declared security_update_not_possible and exited 1 → the workflow_run concluded failure.

This is not a build/test failure — the app is fine and deploys are unaffected (@babel/core is dev-only tooling, never shipped to users; npm audit --omit=dev is clean). But the Dependabot alert stays open and every security-update retry re-fails the workflow until the advisory is closed.

Fix

Add an npm overrides pin of @babel/core to ^7.29.6 — the exact pattern this repo already uses for postcss and js-cookie (with a matching overridesNotes entry explaining the rationale and removal condition). This is Dependabot's own recommended resolution (#2: "Add an override/resolution to pin @babel/core to a non-vulnerable version compatible with your dependencies").

7.29.6 satisfies both transitive edges (^7.24.4 and ^7.0.0), so no dependency is downgraded — eslint-plugin-react-hooks resolves unchanged at 7.1.1.

Verification (sandbox, real tool output)

Check	Result
@babel/core resolves to	7.29.7 (≥ 7.29.6, non-vulnerable)
eslint-plugin-react-hooks	unchanged at 7.1.1 (no downgrade)
npm run build	✅ built in 327ms
npm test (vitest run)	✅ 85/85 passed
npm audit --audit-level=high --omit=dev (CI prod gate)	✅ 0 vulnerabilities
package-lock.json	regenerated (npm install --package-lock-only)

The 2 remaining npm audit high-severity entries (brace-expansion, nanoid) are pre-existing and unrelated to this run.

Files

• frontend/package.json — added @babel/core: ^7.29.6 to overrides + overridesNotes
• frontend/package-lock.json — regenerated

Once merged, the next Dependabot security-update run for @babel/core will find the resolved version already non-vulnerable and close the alert automatically.