Sync main into dev: brace-expansion CVE patch (#110) - #119

Reconciles #110 (brace-expansion 1.1.15 -> 1.1.16), which was merged directly
into `main` as a Dependabot security update, ahead of the v0.2.0 promotion.
`main` was not an ancestor of `dev` — #119 replicated #110's change on `dev`
rather than merging `main` — so both branches had independently edited
frontend/package-lock.json and the promotion PR would not merge.

frontend/package-lock.json resolved in favour of `dev`. Verified this cannot
resolve away from the security fix: no package is present on `main` and absent
from `dev`, and the only version differences are the app version (0.1.0 ->
0.2.0) and brace-expansion 1.1.16 -> 1.1.18 / 2.1.3 -> 2.1.4, both of which
move forward past what `main` carries.

# Conflicts:
#	frontend/package-lock.json

Squashing a promotion replaces dev's commits with one new commit on main that
has no ancestry link to them, so main and dev diverge the instant it lands and
every subsequent back-merge becomes a conflict-resolution exercise against a
squashed copy of work dev already has.

That is not theoretical here. Because main was not an ancestor of dev, #110 (a
Dependabot security update, which lands on main) could not be back-merged
cheaply, so #119 replicated its change on dev instead of merging main. Both
branches had then independently edited frontend/package-lock.json and the
v0.2.0 promotion PR opened dirty — requiring a hand-picked side on a file where
picking wrong silently reverts a security fix.

A merge commit removes the cause: main keeps the individual commits a release
should preserve, dev stays an ancestor of main, and the back-merge becomes a
fast-forward. Feature and contribution PRs into dev are unchanged and still
squash-merged; the rule is asymmetric on purpose.

Corrects the three passages that assumed squashing: the back-merge guidance in
both documents (a promotion's back-merge now fast-forwards; the resolve-in-
favour-of-dev rule stays for commits that landed on main independently, with a
new check that dev is genuinely ahead first), and the git-identity note, which
described squash-merge authorship but applies equally to a merge commit.

Also logs the release-prep follow-ups in §14: the CHANGELOG backfill, the
README tag-example fix, and tracking issues for three dependency findings —
#123 (react-router GHSA-qwww-vcr4-c8h2, runtime dep but not reachable outside
RSC mode), #124 (postcss, dev-only, patch-level fix available) and #125
(brace-expansion GHSA-mh99-v99m-4gvg, no fix on the 1.x or 2.x lines, so the
1.1.18 bump clears nothing).