security(deps): patch react-router 7.14.x -> 7.16.0 (GHSA-49rj-9fvp-4h2h et al.)

Two high-severity advisories against react-router 7.0.0-7.14.2 (turbo-stream deserialization RCE, protocol-relative open redirect, __manifest DoS) started failing the frontend npm-audit gate after the last green deploy. npm audit fix bumps within the existing ^7.13.2 range (lockfile only); audit is clean, the production bundle builds, and vitest (99 tests) passes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Sbussiso