Update dependencies to latest allowed versions

[kmcginnes]

Summary

Routine refresh that moves every dependency to the newest version our policies allow.

 dependencies
+  ~30 direct packages to latest (patch/minor, plus happy-dom 20 → 21)
+  @types/node to the latest 24.x
-  @types/flat (flat 6 ships its own types)
 code
+  ImportCard narrows the radix checkbox value to a boolean, matching CheckboxField
 Dockerfile
+  Amazon Linux base image to the latest snapshot
 .github/dependabot.yml
~  Babel 8 hold: rationale corrected

Still held: @babel/core 8, @types/node majors, and cva.

The old Dependabot comment said Babel 8 stable could not resolve. It does resolve, and it builds and passes tests. However, babel-plugin-react-compiler still depends on @babel/types 7, and under Babel 8 the bundle has 506 memo cache slots instead of 530. So some components silently lose compilation. The comment now records that reason.

Evidence

Before: radix-ui 1.8 typed onCheckedChange with 'indeterminate', so ImportCard failed the typecheck.
After: pnpm checks, pnpm test (3343 passing), pnpm build, and pnpm dedupe --check all pass.

Merge Danger

Door: two-way

Impact: minimal

[kmcginnes]

Approved