chore: update stem toolchain dependencies

[krisarmstrong]

Summary

Updates Stem to the latest pinned toolchain/dependency set and keeps CI/local validation aligned:

• Bumps Node/npm pins and makes CI install npm 11.18.0 explicitly.
• Updates Go, npm, Biome, Vite/Vitest/Playwright/React/Tailwind and related lockfiles.
• Migrates CI typecheck to the repo's npm run typecheck script using tsgo.
• Adds the missing @tanstack/react-query dependency already used by the UI.
• Removes the stale help-content barrel file and switches callers to direct help corpus imports so Biome passes without ignores.

Linked Issue

Related to #493

Type of Change

• Defect fix
• Feature
• Chore / refactor / dependency update
• Documentation
• CI / release / packaging
• Security hardening

Risk

• Low
• Medium
• High

Testing Evidence

node --version
v26.4.0

npm --version
11.18.0

go version
go version go1.26.4 darwin/arm64

npm_config_cache=/tmp/msn-npm-cache npm ci --ignore-scripts
added 103 packages, and audited 104 packages
found 0 vulnerabilities

cd ui && npm_config_cache=/tmp/msn-npm-cache npm ci --ignore-scripts
added 358 packages, and audited 359 packages
found 0 vulnerabilities

cd ui && npm run typecheck
> tsgo --build --noEmit
PASS

cd ui && npx @biomejs/biome check src/
Checked 192 files. No fixes applied.

npm audit --audit-level=high
found 0 vulnerabilities

cd ui && npm audit --audit-level=high
found 0 vulnerabilities

GOMODCACHE=/tmp/msn-gomodcache GOCACHE=/tmp/msn-gocache go test ./...
ok github.com/MustardSeedNetworks/stem/internal/api 163.746s
ok github.com/MustardSeedNetworks/stem/internal/license 57.111s
all packages passed

GOMODCACHE=/tmp/msn-gomodcache GOCACHE=/tmp/msn-gocache GOLANGCI_LINT_CACHE=/tmp/msn-golangci-lint-cache npm_config_cache=/tmp/msn-npm-cache make lint
0 issues.
✓ Go lint passed
Checked 192 files. No fixes applied.
✓ Frontend lint complete
✓ All linters passed

GOMODCACHE=/tmp/msn-gomodcache GOCACHE=/tmp/msn-gocache npm_config_cache=/tmp/msn-npm-cache make build
✓ built in 1.28s
Built: bin/stem
Build complete: bin/stem

git diff --check
PASS

Security and Release Checklist

• No secrets, tokens, credentials, or customer data are included.
• Mutating routes, auth surfaces, permission checks, and output encoding were reviewed if touched.
• Dependencies are pinned and justified if changed.
• Documentation, screenshots, or operator notes were updated if behavior changed.

[github-actions]

License Compliance Report

All dependencies pass license compliance checks

Go Dependencies

• Unknown: 35 package(s)
• MIT: 25 package(s)
• BSD-3-Clause: 16 package(s)
• Apache-2.0: 11 package(s)
• BSD-2-Clause: 1 package(s)

npm Dependencies

See full report in workflow artifacts

Allowed Licenses: MIT, Apache-2.0, BSD-*, ISC, CC0-1.0, MPL-2.0
Forbidden: GPL, AGPL, SSPL (strong copyleft)

[github-actions]

License Compliance Report

All dependencies pass license compliance checks

Go Dependencies

• Unknown: 35 package(s)
• MIT: 25 package(s)
• BSD-3-Clause: 16 package(s)
• Apache-2.0: 11 package(s)
• BSD-2-Clause: 1 package(s)

npm Dependencies

See full report in workflow artifacts

Allowed Licenses: MIT, Apache-2.0, BSD-*, ISC, CC0-1.0, MPL-2.0
Forbidden: GPL, AGPL, SSPL (strong copyleft)