chore(deps): update frontend dependencies

Majors: i18next 26 -> 27.1.1 with react-i18next 17 -> 18.0.1, and jsdom
30 -> 31. The vitest group moves together to 5.1.0 (vitest, coverage-v8,
browser-playwright and the addon-vitest override). Also antd 6.7.0,
storybook 10.6.7, vite 8.3.8, @vitejs/plugin-react 6.3.0, react-query
5.107.1, react-hook-form 7.92.0, msw 3.0.5, playwright 1.65.0, otpauth
9.6.0 and oxfmt 0.78.0.

i18next 27 dropped interpolation.nestingPrefixEscaped, the option that kept
"$t(...)" nesting from ever matching, and an empty nestingPrefix falls back
to "$t(". The prefix is now a NUL character, which no translation or
node-reported text contains; node-list-untrusted-i18n.test.tsx goes red
without it.

Held back: oxlint stays at 1.90.0, because 1.91 and later flag six
fetch-in-effect loaders with react(set-state-in-effect) and those need a
data-loading rewrite of their own. @hookform/resolvers 7.0.6 and
oxlint-tsgolint 7.0.2007 are less than a day old, so 7.0.5 and 7.0.2006
are locked; the lockfile was resolved with a one-day cutoff.

frontend/src/i18n/react.ts

@@ -9,14 +9,13 @@ import enUS from '../../../internal/web/translation/en-US.json';
 
 const FALLBACK = 'en-US';
 
-// No locale uses $t(...) nesting, and its regex backtracks exponentially on an unclosed
-// "$t(" in untrusted text (node-reported names, remarks); no off switch, so never match.
+// No locale uses $t(...) nesting, and untrusted text (node-reported names, remarks) must not
+// reach it; i18next 27 has no off switch, so the prefix is a NUL that no text contains.
 export const INTERPOLATION: InterpolationOptions = {
   escapeValue: false,
   prefix: '{',
   suffix: '}',
-  nestingPrefix: '',
-  nestingPrefixEscaped: '(?!)',
+  nestingPrefix: '\u0000',
 };
 
 const lazyModules = import.meta.glob([