chore: secure frontend build toolchain

docs/CODEX_EXECUTION_LOG.md

@@ -7587,12 +7587,12 @@ Open:
 ## Local validation
 
 - `bash scripts/run_readiness_check.sh` passed end to end.
-- Full backend suite passed: `508` tests after the final coverage, manifest
-  provenance and framework-contract regression additions.
+- Full backend suite passed: `509` tests after the final coverage, manifest
+  provenance, framework-contract and frontend-toolchain regression additions.
 - API contract audit passed with `81` implemented routes and the two documented
   non-envelope endpoints.
 - Alembic reports one head: `202606120900`.
-- Frontend TypeScript checking and production build passed with `85` modules;
+- Frontend TypeScript checking and Vite 7 production build passed with `82` modules;
   the dedicated MapLibre chunk remains intact.
 
 ## Next pass
@@ -7635,6 +7635,16 @@ Open:
   favor of `httpx2`. Kept Starlette on the still-supported
   `>=0.46.0,<1.0.0` line until that test-client migration receives a dedicated
   compatibility pass; the release gate consequently remains warning-free.
+- The cache-free frontend dependency install exposed one high and one moderate
+  Vite/esbuild development-server advisory. Upgraded only the build toolchain
+  to Vite `7.3.6` and React plugin `5.2.0`, retained React 18 and MapLibre 4,
+  and declared Node `^20.19.0 || >=22.12.0`. `npm audit`, TypeScript checking
+  and the production build then passed with zero known vulnerabilities.
+- A full cache-free Tower image build installed the complete Debian GIS stack,
+  Starlette `0.52.1`, FastAPI `0.139.0`, PyTorch `2.13.0+cpu`, TorchVision
+  `0.28.0+cpu` and Ultralytics `8.4.95`. GIS import smoke, model-file
+  discovery, PostGIS `3.6`, schema/index checks, migration head and browser
+  proxy verification all passed from the newly built image.
 
 ## Decision