fix: restore workbox v7 hoisting and pin eslint-plugin-react-hooks

Yarn happened to hoist workbox-*@7.4.x to the top of node_modules because
`workbox-window` and `workbox-webpack-plugin` are direct deps; npm's
alphabetical hoist resolution instead picks the older 4.3.1 versions that
arrive via hyperlink → assetgraph → workbox-build@4.3.1. The 4.x API has
no `CacheableResponsePlugin` / `ExpirationPlugin` (they were named
`Plugin`), so src/sw.js fails the import/named lint rule.

- Declare the workbox-* packages src/sw.js consumes as direct
  dependencies at ^7.4.0 so npm hoists v7 alongside workbox-window.
- Drop the now-unnecessary eslint-disable for import/no-extraneous-dependencies.
- Pin eslint-plugin-react-hooks to 7.0.1 via overrides. The yarn.lock on
  main pinned 7.0.1; regenerating the lockfile with the existing
  `^7.0.1` range bumped it to 7.1.1, which introduces the new
  `react-hooks/set-state-in-effect` rule and surfaces unrelated lint
  failures.

Author: claude