chore(deps): refresh dependencies and keep updates manageable

[Go2Engle]

Summary

Refresh the backed-up app dependencies against current main and keep CodeQL initialization and analysis on the same version. Reduce routine Dependabot PR volume and keep Node types aligned with the Node 22 build runtime.

Type of Change

Infrastructure/CI

Technical Details

• Update Electron to 44.7.0, lucide-react to 1.52.0, Prettier to 3.9.9, and tsx to 4.23.15.
• Apply the reviewed source-map-js 1.2.2 and brace-expansion patch updates without unrelated native dependency metadata changes.
• Update both CodeQL steps to the same pinned 4.38.3 revision.
• Group CodeQL updates together and group routine minor/patch app dependencies, development tools, and workflow actions. Keep Electron updates separate for installer validation.
• Add weekly website dependency checks with a chore(site) prefix and a separate website group.
• Ignore major @types/node updates while builds use Node 22; retain current Node 22 types.
• Supersede Dependabot PRs chore(deps-dev): bump electron from 44.4.2 to 44.7.0 #63, chore(deps): bump lucide-react from 1.47.0 to 1.52.0 #64, chore(deps-dev): bump prettier from 3.9.6 to 3.9.9 #65, chore(deps-dev): bump tsx from 4.23.13 to 4.23.15 #66, chore(deps-dev): bump brace-expansion from 1.1.18 to 1.1.21 #79, chore(deps): bump source-map-js from 1.2.1 to 1.2.2 #86, chore(deps): bump github/codeql-action/analyze from 4.38.1 to 4.38.3 #114, and chore(deps): bump github/codeql-action/init from 4.38.1 to 4.38.3 #115. Replace chore(deps-dev): bump @types/node from 22.20.1 to 25.9.8 #62 with the Node runtime alignment policy.

Testing Performed

• Clean root and website dependency installs.
• All 210 app tests passed and the application production build passed.
• All 17 website tests passed; the offline website build verified 12 pages and 20 releases.
• Dependabot YAML parsing and git diff --check passed.
• GitHub Linux and Windows CI and CodeQL passed on commit c31134c769c8ce439ab4f38e30beb6f6e1abb61d.
• Electron 44.7.0 desktop smoke test passed with an isolated profile and no renderer errors.
• Installer validation passed for macOS universal, Windows x64, and Linux x64; all three installer artifacts were uploaded. The workflow resolved and built the same cleanup commit.

Breaking Changes

None. Existing application behavior and the Node 22 build runtime are retained.