chore: bump low-risk frontend/backend dependency versions

[tsg21]

Summary

Routine dependency audit. Bumps the low-risk, non-breaking updates only:

• eslint-plugin-react-hooks 7.0.1 → 7.1.1 (minor)
• typescript-eslint 8.58.1 → 8.66.0 (minor)
• backend/uv.lock refreshed: h2 4.4.0 → 4.4.1 (transitive patch, no CVE — just a routine release)

Security

• npm audit: 0 vulnerabilities
• pip-audit (backend): no known vulnerabilities

Not included here — flagged for manual review

These have breaking-change surface and weren't auto-applied:

• Frontend majors: eslint 9→10, typescript 5.9→7.0, jsdom 29→30, @testing-library/jest-dom 6→7, lucide-react 0.577→1.28, @eslint/js 9→10
• GitHub Actions: actions/setup-node v4→v7, google-github-actions/auth v2→v3, google-github-actions/setup-gcloud v2→v3 — all majors requiring Node 24+ on the runner (satisfied by ubuntu-latest), so should be safe, but this session's credentials don't have the workflow OAuth scope needed to push changes to .github/workflows/*. Recommend applying these bumps manually.
• Terraform: hashicorp/google provider ~> 6.0 → latest 7.42.0 (major, breaking). Left untouched per repo guidance that infra changes affecting live Cloud Run/IAM need careful blast-radius review before touching.

Test plan

• npm install succeeds, npm audit clean
• uv sync --locked succeeds after lock refresh
• CI (frontend lint/typecheck/test/build, backend lint/test) — will monitor and fix if it fails

---

Generated by Claude Code

[tsg21]

Pushed a fix for the frontend lint failure — the typescript-eslint/eslint-plugin-react-hooks 7.1 bump enabled two new rules (react-hooks/set-state-in-effect, react-hooks/refs) that flagged 5 pre-existing patterns:

• DesignsWorkspace, ResearchWorkspace, useGameState: state resets triggered by a derived value change, moved from an effect to the React-recommended "adjust state during render" pattern.
• GameLobby, useGameState: async data-fetch callbacks invoked directly from a triggering effect. Deferred the call with queueMicrotask so the effect's commit finishes before the fetch's setState calls land — the actual concern the rule flags — without touching the fetch callbacks themselves.
• useGameState: a ref write during render moved into an effect (all reads happen from async callbacks after commit, so this is behaviourally equivalent).

Verified locally: eslint, tsc typecheck, vitest (355 passed), and vite build all pass. Watching CI on the new commit.

---

Generated by Claude Code