Refresh app dependencies and pnpm config

[what256]

What changed

• refresh compatible frontend dependencies and the pnpm lockfile
• refresh compatible Rust dependencies in Cargo.lock
• pin pnpm 11.12.0 for reproducible installs
• migrate the esbuild script allowlist to pnpm 11's allowBuilds configuration

Why

The previous pnpm configuration used onlyBuiltDependencies, which pnpm 11 no longer reads. That caused clean installs to stop before typechecking or building.

Impact

Fresh installs work with the pinned package manager, dependency build scripts remain explicitly scoped, and the application stays on its current React, Tailwind, TypeScript, and Vite major versions.

Validation

• pnpm run typecheck
• pnpm run lint
• pnpm run build
• cargo test --lib --locked — 14 passed
• git diff --check

The full ExifTool integration suite remains Windows-specific and requires the gitignored bundled ExifTool resources.