chore(deps): raise react-router-dom peer floor past security advisory

[Bccorb]

What

Raise the react-router-dom v7 peer floor from ^7.0.0 to ^7.15.1 to steer adopters past a high-severity advisory, and refresh the lockfile so this repo's own install uses the fixed version.

The advisory

react-router 7.0.0 through 7.15.0 has a high-severity issue in its vendored turbo-stream (arbitrary constructor invocation via deserialization). Our peer range ^7.0.0 permitted the entire vulnerable band with no floor. React Router 6 is unaffected, so ^6.4.0 is unchanged.

• Peer floor: ^6.4.0 || ^7.0.0 -> ^6.4.0 || ^7.15.1
• Lockfile: react-router 7.13.0 -> 7.18.1

npm audit no longer reports react-router. The suite passes on 7.18.1 (the SDK uses only stable declarative APIs: useNavigate, useHref, useSearchParams, Routes, Route, MemoryRouter), and the packed output is unchanged.

Why a peer bump rather than a pin

react-router-dom is a peer dependency, so adopters resolve their own copy and the SDK cannot pin it for them. Raising the floor is the available lever: npm warns an adopter still on a vulnerable v7 until they move to 7.15.1 or later. The lockfile change only affects this repo's CI and dev install.

Separate finding, not fixed here

While tracing the audit I found a residual moderate (js-yaml) in the production dependency tree, reachable through eslint-plugin-license-header -> eslint -> js-yaml. The root cause is that eslint-plugin-license-header and ts-node are declared in dependencies rather than devDependencies. They are lint and build tooling, so they should not be runtime dependencies: today every adopter installs the full eslint toolchain (and its vulnerable js-yaml) transitively for no reason.

That is a dependencies reorganization rather than a security patch bump, and it wants its own verification (confirm nothing in the build path needs them at runtime), so I kept it out of this PR. Worth a focused follow-up. Flagging rather than filing per the current workflow.

Checks

• npm run typecheck, npm run lint, npm run format:check clean
• Full suite: 223 passed on react-router 7.18.1
• npm audit no longer reports react-router
• npm run check-npm-build: packed output unchanged
• Changeset (patch)