chore: upgrade npm packages for security and stability

Backend upgrades:
- i18next: 25.3.1 → 25.3.2 (patch)
- bcrypt: 5.1.1 → 6.0.0 (maintains compatibility)
- nodemailer: 6.10.1 → 7.0.5 (no AWS SES impact)
- sharp: 0.32.6 → 0.34.3 (image processing)
- chokidar: 3.6.0 → 4.0.3 (file watching)

Frontend upgrades:
- date-fns: 2.30.0 → 4.1.0 (date utilities)
- lucide-react: 0.292.0 → 0.525.0 (icons)
- react-toastify: 9.1.3 → 11.0.5 (notifications)

All upgrades tested, 0 npm audit vulnerabilities maintained.
Deferred high-risk upgrades (archiver, React 19, Express 5).

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>

package-upgrade-summary-2025-07-22.md

@@ -0,0 +1,45 @@
+# Package Upgrade Summary - Production System
+Date: 2025-07-22
+
+## ✅ Successfully Upgraded (8 packages)
+
+### Phase 1 (Low Risk):
+**Backend:**
+- i18next: 25.3.1 → 25.3.2
+- bcrypt: 5.1.1 → 6.0.0
+- nodemailer: 6.10.1 → 7.0.5
+
+**Frontend:**
+- date-fns: 2.30.0 → 4.1.0
+- lucide-react: 0.292.0 → 0.525.0
+
+### Phase 2 (Medium Risk - Carefully Tested):
+**Backend:**
+- sharp: 0.32.6 → 0.34.3
+- chokidar: 3.6.0 → 4.0.3
+
+**Frontend:**
+- react-toastify: 9.1.3 → 11.0.5
+
+## 🚫 Deferred Upgrades (High Risk)
+
+### Critical Bug Found:
+- **archiver**: MUST stay at 5.3.2 (v7 has append() bug that breaks watermarks)
+
+### Major Breaking Changes:
+- express 4 → 5
+- knex 2 → 3
+- React 18 → 19
+- tailwindcss 3 → 4
+
+## Security Status
+- **npm audit vulnerabilities: 0** ✅
+- All upgraded packages tested and working
+- No known security issues in current packages
+
+## Backup Locations
+- Phase 1: `/backups/phase1-upgrade-20250722-103923/`
+- Phase 2: `/backups/phase2-upgrade-20250722-104940/`
+
+## Production Ready
+All upgrades have been tested and are ready for production deployment. Monitor closely for 48 hours after deployment.