chore(deps): update frontend dependencies

Majors: i18next 26 -> 27.1.1 with react-i18next 17 -> 18.0.1, and jsdom
30 -> 31. The vitest group moves together to 5.1.0 (vitest, coverage-v8,
browser-playwright and the addon-vitest override). Also antd 6.7.0,
storybook 10.6.7, vite 8.3.8, @vitejs/plugin-react 6.3.0, react-query
5.107.1, react-hook-form 7.92.0, msw 3.0.5, playwright 1.65.0, otpauth
9.6.0 and oxfmt 0.78.0.

i18next 27 dropped interpolation.nestingPrefixEscaped, the option that kept
"$t(...)" nesting from ever matching, and an empty nestingPrefix falls back
to "$t(". The prefix is now a NUL character, which no translation or
node-reported text contains; node-list-untrusted-i18n.test.tsx goes red
without it.

Held back: oxlint stays at 1.90.0, because 1.91 and later flag six
fetch-in-effect loaders with react(set-state-in-effect) and those need a
data-loading rewrite of their own. @hookform/resolvers 7.0.6 and
oxlint-tsgolint 7.0.2007 are less than a day old, so 7.0.5 and 7.0.2006
are locked; the lockfile was resolved with a one-day cutoff.

frontend/package.json

@@ -38,50 +38,50 @@
     "@ant-design/icons": "^6.3.4",
     "@codemirror/lang-json": "^6.0.2",
     "@codemirror/theme-one-dark": "^6.1.3",
-    "@hookform/resolvers": "^7.0.1",
+    "@hookform/resolvers": "^7.0.5",
     "@noble/hashes": "^2.4.0",
-    "@tanstack/react-query": "^5.105.1",
-    "@tanstack/react-query-devtools": "^5.105.1",
-    "antd": "^6.6.8",
+    "@tanstack/react-query": "^5.107.1",
+    "@tanstack/react-query-devtools": "^5.107.1",
+    "antd": "^6.7.0",
     "codemirror": "^6.0.2",
     "dayjs": "^1.11.23",
-    "i18next": "^26.6.0",
-    "otpauth": "^9.5.2",
+    "i18next": "^27.1.1",
+    "otpauth": "^9.6.0",
     "persian-calendar-suite": "^1.5.6",
     "react": "^19.3.1",
     "react-dom": "^19.3.1",
-    "react-hook-form": "^7.91.0",
-    "react-i18next": "^17.1.10",
+    "react-hook-form": "^7.92.0",
+    "react-i18next": "^18.0.1",
     "react-router": "^8.5.1",
     "swagger-ui-react": "^5.34.1",
     "uplot": "^1.6.32",
     "zod": "^4.6.7"
   },
   "devDependencies": {
-    "@storybook/addon-a11y": "^10.6.5",
-    "@storybook/addon-docs": "^10.6.5",
-    "@storybook/addon-vitest": "^10.6.5",
-    "@storybook/react-vite": "^10.6.5",
+    "@storybook/addon-a11y": "^10.6.7",
+    "@storybook/addon-docs": "^10.6.7",
+    "@storybook/addon-vitest": "^10.6.7",
+    "@storybook/react-vite": "^10.6.7",
     "@testing-library/dom": "^10.4.2",
     "@testing-library/react": "^16.3.3",
     "@types/react": "^19.3.0",
     "@types/react-dom": "^19.3.0",
     "@types/swagger-ui-react": "^5.18.0",
-    "@vitejs/plugin-react": "^6.1.2",
-    "@vitest/browser-playwright": "5.0.5",
-    "@vitest/coverage-v8": "^5.0.5",
+    "@vitejs/plugin-react": "^6.3.0",
+    "@vitest/browser-playwright": "5.1.0",
+    "@vitest/coverage-v8": "^5.1.0",
     "husky": "^9.1.7",
-    "jsdom": "^30.1.3",
+    "jsdom": "^31.0.0",
     "lint-staged": "^17.6.0",
-    "msw": "^3.0.3",
-    "oxfmt": "0.75.0",
+    "msw": "^3.0.5",
+    "oxfmt": "0.78.0",
     "oxlint": "1.90.0",
-    "oxlint-tsgolint": "^7.0.2005",
-    "playwright": "^1.64.1",
-    "storybook": "^10.6.5",
+    "oxlint-tsgolint": "^7.0.2006",
+    "playwright": "^1.65.0",
+    "storybook": "^10.6.7",
     "typescript": "7.0.2",
-    "vite": "8.3.5",
-    "vitest": "^5.0.5"
+    "vite": "8.3.8",
+    "vitest": "^5.1.0"
   },
   "overrides": {
     "dompurify": "^3.4.17",
@@ -104,9 +104,9 @@
       "valibot": "^1.1.0"
     },
     "@storybook/addon-vitest": {
-      "vitest": "5.0.5",
-      "@vitest/browser-playwright": "5.0.5",
-      "@vitest/browser": "5.0.5"
+      "vitest": "5.1.0",
+      "@vitest/browser-playwright": "5.1.0",
+      "@vitest/browser": "5.1.0"
     },
     "remarkable": {
       "argparse": "^2.0.1"

frontend/src/i18n/react.ts

@@ -9,14 +9,13 @@ import enUS from '../../../internal/web/translation/en-US.json';
 
 const FALLBACK = 'en-US';
 
-// No locale uses $t(...) nesting, and its regex backtracks exponentially on an unclosed
-// "$t(" in untrusted text (node-reported names, remarks); no off switch, so never match.
+// No locale uses $t(...) nesting, and untrusted text (node-reported names, remarks) must not
+// reach it; i18next 27 has no off switch, so the prefix is a NUL that no text contains.
 export const INTERPOLATION: InterpolationOptions = {
   escapeValue: false,
   prefix: '{',
   suffix: '}',
-  nestingPrefix: '',
-  nestingPrefixEscaped: '(?!)',
+  nestingPrefix: '\u0000',
 };
 
 const lazyModules = import.meta.glob([