build(deps): DEP-6 — build toolchain (loaders, asset modules) (WALLET-1332) (#1382)

* build(deps): bump Node 18 → 22 LTS + build-time RCE fix (WALLET-1327)

Bump .nvmrc to v22.23.1 (Jod LTS, >=22.18 for future Babel 8) and Node in all 4 CI workflows; add engines field. Land the Node-gated build-tool bumps that transitively resolve the serialize-javascript advisory: web-ext 8->10.4, copy-webpack-plugin 11->14, terser-webpack-plugin 5.3.6->5.6.1 (serialize-javascript now 7.0.6 only). Switch ci-check install to npm ci. No app-code changes.

* fix(deps): remediate npm audit vulnerabilities (WALLET-1328)

Only one finding reaches the shipped bundle — i18next-http-backend's
path-traversal via unsanitised lng/ns — so it is upgraded outright; the
build-time serializer is treated as production-impacting and pinned via
overrides. Everything else is dev/build-toolchain and accepted dev-only.

- i18next-http-backend 2.5.0 -> ^3.0.5 (v3 uses global fetch; zero source
  change — i18n.ts has no backend:{} options block)
- overrides += serialize-javascript ^7.0.5 (CVE-2026-34043), tmp ^0.2.7
  (CVE-2026-44705); the override is mandatory — the webpack plugins resolve
  serialize-javascript to a vulnerable 6.x with no patch
- add audit:ci script (npm audit --omit=dev --audit-level=high) wired into
  CI as a blocking runtime gate plus a non-blocking full-tree audit
- regenerate package-lock.json under Node 22

Runtime audit clean (0). Residual is 16 dev-only advisories (0 critical),
all under @redux-devtools/* and webpack-dev-server — never bundled.

* test(crypto): pin vault AES-GCM blob byte-format before micro-aes-gcm swap (WALLET-1330)

* refactor(crypto): replace deprecated micro-aes-gcm with @noble/ciphers gcm (WALLET-1330)

* build(deps): migrate @lapo/asn1js to v2 ESM named exports (WALLET-1330)

* build(deps): bump @noble/ciphers to v2 + libsodium floor; record @Scure v1 hold (WALLET-1330)

* fix(deps): scope router to path-to-regexp v8 to unbreak start:chrome (WALLET-1328)

* build(deps): bump Ledger transports, zondax, bringweb3, react-query (WALLET-1329)

Bump all 4 Ledger transports together (hw-transport/webhid to ^6.35.4,
webusb/web-ble to ^6.34.4), @zondax/ledger-casper to ^2.6.4,
@bringweb3/chrome-extension-kit to 1.7.0, and @tanstack/react-query to
^5.101.2. Add an override deduping @ledgerhq/hw-transport to a single
version, since @zondax/ledger-casper@2.6.4 newly pins 6.31.16. Add
@ledgerhq/devices as an explicit direct dep since transport.ts imports
it and deep-imports hw-transport-webusb/lib/webusb. casper-js-sdk and
casper-wallet-core are untouched (held/out of scope for this phase).

* build(deps): bump test toolchain to Jest 30, testing-library 16, Playwright 1.61 (WALLET-1331)

Resolves the moderate node-notifier advisory carried by the Jest 29 chain.
Jest 30 drops the toThrowError matcher alias, and Playwright 1.57+ switched
the default chromium channel to Chrome-for-Testing, which needs an explicit
channel pin for the unpacked-extension e2e harness.

* chore(deps): drop dead jest.e2e.config.js/jest.tsconfig.json and unused RTL deps (WALLET-1331)

jest.e2e.config.js and jest.tsconfig.json were unreferenced by any script or
CI job; jest-environment-jsdom only existed to back that dead config's
testEnvironment:'jsdom'. @testing-library/react, @testing-library/dom and
@testing-library/user-event have zero imports in src or e2e-tests.
@testing-library/jest-dom stays: it's wired into jest.config.js
setupFilesAfterEnv and typed in src/global.d.ts.

* build(deps): DEP-6 — bump build toolchain (loaders, asset modules) (WALLET-1332)

Bump webpack ^5.108.1, css-loader ^7.1.2, style-loader ^4.0.0, html-loader
^5.1.0, babel-loader ^10.0.0, dotenv-webpack ^9.0.0. Remove unused
webpack-cli, url-loader, file-loader, @babel/plugin-proposal-class-properties
(0 import sites / never invoked). Convert the file-loader rule to a native
webpack 5 asset/resource module to drop the dependency without changing
behavior.

Also drops an unused `Page` import from e2e-tests/constants.ts.

---------

Co-authored-by: Dmytro Vynnyk <simbiatoff@gmail.com>

Author: ost-ptk

e2e-tests/constants.ts

@@ -1,7 +1,5 @@
-import { Page } from '@playwright/test';
 import path from 'path';
 
-
 export const newPassword = 'this is new password';
 export const vaultPassword = '3hQqzYn4C7Y8rEZTVEZb';
 export const twentyFourWordsSecretPhrase =