chore: address clawpatch review findings (test scope, deps, legal-page hardening)

- frontend: `npm test` now runs all 7 vitest suites instead of one hardcoded
  file; the previously skipped ProtectedImage / Skeleton / usePublicSettings /
  contrast / themeMigration / url suites are now active in CI
- frontend: wrap ThemeCustomizerEnhanced test in QueryClientProvider so the
  newly-enabled run passes (component uses useQuery internally)
- root: drop unused better-sqlite3 / canvas / node-fetch + their
  prebuild-install/tar-fs override (backend keeps its own copies); add dotenv
  so playwright.config.ts can load on a clean install; add name/version/private
- LegalPage: scheme-validate external_url before window.location.replace so a
  CMS edit can't redirect visitors to javascript:/data:
- LegalPage: force rel="noopener noreferrer" on target="_blank" anchors in
  sanitized CMS HTML to block reverse-tabnabbing

frontend/package.json

@@ -9,7 +9,7 @@
     "build:check": "tsc -b && node ./scripts/build.js",
     "lint": "eslint .",
     "preview": "vite preview",
-    "test": "vitest run src/components/admin/__tests__/ThemeCustomizerEnhanced.test.tsx",
+    "test": "vitest run",
     "i18n:extract": "i18next-cli extract",
     "i18n:status": "i18next-cli status",
     "i18n:ci": "i18next-cli extract --ci --dry-run"