Deliver scoped UI dependency security remediation

Scoped delivery record for the dependency remediation implemented by !1179 (merged).

Parent program: #645

Done when the MR has a green required pipeline, fresh independent final-head review, explicit human approval, and resolved blocking discussions. The broader frontend-upgrade program remains open.