Document frontend dependency maintenance

docs/DEVELOPMENT_AND_STAGING.md

@@ -101,6 +101,18 @@ At minimum, verify:
 8. Ūdens temperatūra accepts all six manual ranges and exports both 1920×1080 and 3840×1440 PNGs.
 9. Browser developer tools show no new runtime errors.
 
+For frontend dependency maintenance, validate the committed lockfile from a clean install rather than relying on an already-mutated `node_modules` tree:
+
+```bash
+docker compose run --rm --no-deps node npm ci
+docker compose run --rm --no-deps node npm run typecheck
+docker compose run --rm --no-deps node npm run build
+docker compose run --rm --no-deps node npm audit
+docker compose run --rm --no-deps node npm audit --omit=dev
+```
+
+At commit `de6f279`, all five checks pass and both audit scopes report zero known vulnerabilities. The npm major-version availability notice is informational and does not require changing the npm version independently of the pinned Node build image.
+
 Known limitation: direct browser refreshes on newer client-side routes such as `/faktiska` can return 404 because the backend static-route list does not yet provide a general SPA fallback. Navigate from the home page until that backend behavior is fixed.
 
 ## Rollback

docs/README.md

@@ -20,6 +20,7 @@ This directory contains the working documentation for the WeatherTool modernizat
 - Approved 1920×1080 and 3840×1440 PNG production bases are now the rendering source for Faktiskā and Ūdens temperatūra; code draws only the changing values, selected weather symbols, and wind data over those fixed newsroom graphics.
 - Browser branding assets and Latvian Open Graph/Twitter metadata are included for favicon, Apple home-screen icon, and link-preview support. Public crawler access still depends on the Nginx/Authelia policy used for the metadata and preview image.
 - Browser verification of release `16a8c68` confirmed both fixed-map workspaces and the favicon. The shared UAT login is ready for the first newsroom-user handoff on 2026-08-21.
+- Frontend dependency maintenance is complete through commit `de6f279`: Solid runtime and Vite tooling were updated, obsolete packages were removed, TypeScript checking was added, and a clean Rocky `npm ci`, typecheck, production build, full audit, and production-only audit all pass with zero known vulnerabilities. These commits are newer than the currently deployed VPS release `16a8c68`.
 - This is not yet approved or hardened for workplace production.
 
 ## Documents

docs/UPDATE_ROADMAP.md

@@ -63,15 +63,17 @@ Status: in progress
 
 ## Phase 3 — Dependency modernization
 
-Status: pending
+Status: in progress — frontend maintenance complete; backend maintenance pending
 
-The first observed frontend install reported 15 vulnerabilities: 1 critical, 10 high, 3 moderate, and 1 low. Exact advisories must be reviewed before choosing upgrades.
+The first observed frontend install reported 15 vulnerabilities: 1 critical, 10 high, 3 moderate, and 1 low. The frontend dependency tree was reviewed in controlled groups, obsolete packages were removed, and both the complete and production-only npm audits now report zero known vulnerabilities at commit `de6f279`.
 
-- [ ] Capture and review the full npm audit report.
+- [x] Capture and review the full npm audit report.
 - [x] Establish that the production dependency audit is primarily blocked by `solid-js@1.9.4` resolving vulnerable `seroval@1.2.0`; confirm that the full audit also contains development-tool advisories.
-- [ ] Update direct frontend dependencies in controlled groups.
-- [ ] Replace or remove obsolete frontend packages where appropriate.
-- [ ] Rebuild and visually compare every page after frontend upgrades.
+- [x] Update direct frontend dependencies in controlled groups.
+- [x] Replace or remove obsolete frontend packages where appropriate.
+- [x] Add a committed TypeScript typecheck command and validate the updated frontend with a clean `npm ci`, typecheck, and production build.
+- [x] Resolve the remaining transitive build-tool advisories after reviewing the proposed `npm audit fix` changes; verify full and production-only audits at zero.
+- [ ] Rebuild, deploy, and visually compare every page in a commit-addressed VPS release containing `de6f279` or later. (Rocky clean-install build verification is complete.)
 - [ ] Update Scala within the supported 2.13 line before considering larger migration.
 - [ ] Update http4s, Doobie, Circe, Cats Effect, Logback, and test libraries in compatible groups.
 - [ ] Replace release-candidate dependencies with stable releases where possible.
@@ -188,3 +190,4 @@ Record completed work here by date and commit after the Git workflow is establis
 | 2026-08-19 | `0d641bd` | Replace runtime Daira glyph rendering with normalized transparent image assets | Yes |
 | 2026-08-20 | `754415a` | Match editable title/source overlays to production-safe right margins | Yes |
 | 2026-08-20 | `16a8c68` | Deploy approved production map bases, normalized branding assets, favicon, Apple icon, and social metadata to public UAT | Yes — Rocky build and VPS/browser smoke checks |
+| 2026-08-21 | `5007517`–`de6f279` | Update Solid runtime and frontend build tooling, add type checking, remove obsolete packages, prune the lockfile, and resolve all npm advisories | Yes — clean `npm ci`, typecheck, production build, full audit, and production-only audit |