Chunk DV-1 of 2026-05-16-dependabot-vulns-remediation.

Closes 6 of 8 open Dependabot alerts on WeLikeCode/mintkey (manifest =
admin-ui/pnpm-lock.yaml):

  Alert #1 MEDIUM CVE-2024-29881 tinymce              <7.0.0   -> 7.9.2
  Alert #2 MEDIUM GHSA-67mh-4wv8 esbuild              <=0.24.2 -> 0.25.12
  Alert #3 HIGH   CVE-2025-59288 playwright           <1.55.1  -> 1.60.0
  Alert #4 LOW    CVE-2025-14284 @tiptap/extension-link <2.10.4 -> 2.27.2
  Alert #5 MEDIUM CVE-2026-39365 vite                 <=6.4.1  -> 6.4.2
  Alert #6 MEDIUM CVE-2026-41691 i18next-http-backend <3.0.5   -> 3.0.6

Mechanism: pnpm `overrides`. Only @playwright/test was a direct dep
(devDependencies; bumped to ^1.55.1, resolves to 1.60.0). The other 5
were transitives reached via adminjs / vitest; forcing patched versions
via overrides was the surgical fix that avoided bumping adminjs (which
would have been a much larger blast radius).

Discovery during implementation: pnpm v11 reads project settings from
`pnpm-workspace.yaml`, NOT from `package.json` `pnpm.overrides` — that
block was silently ignored on this codebase since the corepack upgrade
to v11. The existing @tiptap/core@2.27.2 + @tiptap/pm@2.27.2 overrides
only worked because `.pnpmfile.cjs` enforces them via readPackage.
Added pnpm-workspace.yaml with all 7 entries (the original 2 + 5 new).
The `pnpm.overrides` block in package.json is preserved for tool
visibility (Dependabot dependency-graph parsing) but is now dead-code
for pnpm itself.

Verification:
  $ pnpm install --frozen-lockfile  -> exit 0
  $ npx tsc --noEmit                -> 157 errors (matches baseline,
                                       pre-existing AdminJS types issue)
  $ pnpm dev + curl localhost:5173/ -> HTTP 200
  $ docker build admin-ui/          -> success
  $ pnpm audit --audit-level=high   -> No known vulnerabilities

Locked decisions:
- Single batched commit (owner-chosen granularity, not per-package)
- Preserved @tiptap/core@2.27.2 + @tiptap/pm@2.27.2 (do not change)
- Preserved adminjs 7.8.x line (avoided 7->8 major bump)

REVIEWER (fresh Opus) PASS_ALL.

Chunk DV-2 of 2026-05-16-dependabot-vulns-remediation.

Closes remaining 2 of 8 open Dependabot alerts on WeLikeCode/mintkey
(manifest = go.mod, root module):

  Alert #7 HIGH CVE-2026-24051 (GHSA-9h8m-3fm2-qjrq) PATH hijacking
  Alert #8 HIGH CVE-2026-39883 (GHSA-hfvc-g4fc-pqhx) BSD kenv abuse

Both apply to go.opentelemetry.io/otel/sdk in the root module's
require block (all marked // indirect, but pulled transitively by
internal/otelinit/init.go). Bumping to v1.43.0 (latest as of
2026-04-03) satisfies BOTH patched-version ranges (>=1.40.0 and
>=1.43.0). The entire OTel sibling suite (otel, otel/sdk, otel/trace,
otel/metric, otel/exporters/otlp/otlptrace, otlptracegrpc) is bumped
in lockstep to preserve ABI alignment.

go mod tidy effects (all expected, none unrelated):
- otel/sdk and otel/exporters/otlp/otlptrace/otlptracegrpc promoted
  from // indirect to direct require (correctly reflects direct
  imports in internal/otelinit/init.go).
- Added transitive: go.opentelemetry.io/auto/sdk v1.2.1,
  go.opentelemetry.io/proto/otlp v1.10.0,
  cenkalti/backoff v4 -> v5 (driven by OTel/grpc graph).
- `go 1.22` directive bumped to `go 1.25.0` — transitive dep in the
  v1.43.0 graph requires Go 1.25 features. Not deliberate; cascade
  of the security bump.

Cascade fix: ci.yml GO_VERSION "1.22" -> "1.26" — needed because root
go.mod now requires go 1.25.0; aligns with Dockerfile golang:1.26-alpine
(dev/CI/prod now consistent).

Verification:
  $ go build ./...                      -> exit 0
  $ go vet ./...                        -> exit 0
  $ go test ./internal/otelinit/...     -> ok
  $ (each of 4 services) go build ./... -> exit 0
  $ grep "otel/sdk v1.2[9-9]\|v1.3[0-9]\|v1.4[0-2]" go.sum services/*/go.sum
                                        -> empty (only v1.43.0 remains)
  $ git diff --name-only -- internal/ admin-api/src/ services/*/internal/
                                        -> empty (no product code touched)

Also: gitignore **/.pnpm-store/ — local pnpm content-addressable
cache that appeared during DV-1's pnpm install regen (same rule as
sister PR #33's .gitignore).

REVIEWER (fresh Opus) PASS_ALL with 2 NITs (one accepted: pnpm.overrides
in package.json kept for Dependabot tool visibility).

REVIEWER PASS_ALL. 2 atomic commits close all 8 alerts.
Cross-dependency on PR #33 documented; merge order matters.