sec(frontend): upgrade @babel/core past 7.29.0 to fix GHSA-4x5r-pxfx-6jf8 (arbitrary file read)

[cristim]

Summary

After PR #872 pinned `@babel/core` to `7.28.5` (matching the existing lockfile), `npm audit` reports:

GHSA-4x5r-pxfx-6jf8 — @babel/core: Arbitrary File Read via sourceMappingURL Comment
Affected: <=7.29.0
Fix: upgrade to 7.29.7+

The fix requires `--force` because 7.29.7 is outside the range `^7.23.0` the project previously used (but the range constraint was the old package.json; after #872 the version is pinned). The fix is: update `@babel/core`, `@babel/preset-env`, `@babel/preset-typescript` to `>=7.29.7` in both `package.json` and run `npm install` to regenerate `package-lock.json`.

Note: this CVE was present in `main`'s lockfile before #872; it is NOT introduced by #872.

Steps

1. npm install @babel/core@^7.29.7 @babel/preset-env@^7.29.7 @babel/preset-typescript@^7.29.7 --save-dev
2. Pin the new resolved versions (exact) in package.json to maintain supply-chain discipline from sec(frontend): pin npm dependencies to exact versions (closes #425) #872.
3. Run npm test to confirm no breakage.

[cristim]

Verification sweep against main (101f099fb) on 2026-07-27 finds this already resolved.
@babel/core is pinned to 7.29.7, past the fix version for GHSA-4x5r-pxfx-6jf8.
Evidence: commit d29a3e0 (PR #872).
Recommending close.

[cristim]

Verified resolved at 3c0f8ac: @babel/core is pinned to 7.29.7 in package.json and the lockfile resolves only that version, which is past the GHSA-4x5r-pxfx-6jf8 fix (7.29.7+). Evidence: frontend/package.json:19, frontend/package-lock.json:80 (#872 commit d29a3e0). Residual axes checked: no nested second @babel/core in the lockfile; @babel/preset-env and @babel/preset-typescript stay at 7.28.5 but are not affected by this advisory. Closing as completed; reopen if the behaviour recurs.