chore: address clawpatch review findings (test scope, deps, legal-page hardening)

- frontend: `npm test` now runs all 7 vitest suites instead of one hardcoded
  file; the previously skipped ProtectedImage / Skeleton / usePublicSettings /
  contrast / themeMigration / url suites are now active in CI
- frontend: wrap ThemeCustomizerEnhanced test in QueryClientProvider so the
  newly-enabled run passes (component uses useQuery internally)
- root: drop unused better-sqlite3 / canvas / node-fetch + their
  prebuild-install/tar-fs override (backend keeps its own copies); add dotenv
  so playwright.config.ts can load on a clean install; add name/version/private
- LegalPage: scheme-validate external_url before window.location.replace so a
  CMS edit can't redirect visitors to javascript:/data:
- LegalPage: force rel="noopener noreferrer" on target="_blank" anchors in
  sanitized CMS HTML to block reverse-tabnabbing

package.json

@@ -1,19 +1,13 @@
 {
+  "name": "picpeak",
+  "version": "0.0.0",
+  "private": true,
   "scripts": {
     "test:e2e": "playwright test"
   },
-  "dependencies": {
-    "better-sqlite3": "^12.2.0",
-    "canvas": "^3.2.0",
-    "node-fetch": "^2.7.0"
-  },
   "devDependencies": {
     "@playwright/test": "^1.57.0",
+    "dotenv": "^16.4.5",
     "puppeteer": "^24.17.0"
-  },
-  "overrides": {
-    "prebuild-install": {
-      "tar-fs": "2.1.4"
-    }
   }
 }