Refresh Dependabot dependencies

[atk0309]

What changed

• upgrade Express to 5.2.1, Resend to 6.18.0, and Playwright to 1.61.1
• regenerate the lockfile cleanly and remove the obsolete optional React-email dependency tree
• migrate the app-shell wildcard route to Express 5 named-wildcard syntax
• add successful mail-provider payload coverage
• extend browser smoke coverage for client fallback plus unknown /api and /auth routes

Why

This supersedes Dependabot PRs #1, #2, and #3 with one current-main refresh. PR #1 exposed an Express 5 startup failure because app.get('*') is rejected by Express 5/path-to-regexp. All three bot PRs were based on the pre-MIT root, while the Resend-generated lock retained an obsolete optional dependency tree.

Validation

• exact tree parity with private source PR #16
• npm ci
• npm run check
• full and production npm audit --audit-level=low — zero vulnerabilities
• npm audit signatures — 119 verified signatures, 5 verified attestations
• credential-free Chromium smoke — root and fallback render, unknown API/auth routes remain 404, zero console/page/network/5xx errors