Prepare v1.0.0 release dependencies

[josh-uk]

Summary

• set the application and lockfile version to 1.0.0
• update the PostCSS security override to 8.5.20
• make the lockfile root dependency declarations consistently exact-pinned

Dependency audit

All runtime dependencies and compatible development dependencies are current. ESLint 10.7.0 and TypeScript 7.0.2 are intentionally not installed because current upstream lint plugins reject those peer combinations; ESLint 9.39.5 and TypeScript 6.0.3 are the newest compatible stable releases.

Validation

• clean npm install and exact top-level dependency tree
• zero npm audit findings
• format, lint, typecheck, 69 unit tests, 19 component tests, production build
• 94.76% statement coverage
• migration consistency and 44 PostgreSQL integration tests
• 10 Chromium end-to-end and Axe accessibility tests
• local linux/amd64 and linux/arm64 container build