feat(HNT-3496): upgrade Apollo Server 3 to 5

[mmiermans]

Goal

Move admin-api off EOL Apollo Server 3 to @apollo/server 5.

• apollo-server-express 3 → @apollo/server 5.5.1 + @as-integrations/express4
• The 289-line upload fork → @profusion/apollo-federation-upload 4.2.0 (with graphql-upload 15)
• @pocket-tools/apollo-utils 2.2.0, which depends on Apollo Server 3, is replaced by a ported 30-line sentryPlugin
• The memcached cache is removed (it was created but never used)
• TypeScript 5.9 (previously 4.7, transitive only), with skipLibCheck; @types/node 24
• Security bumps: @apollo/gateway 2.13.4 (drops vulnerable tar/ip), express 4.22.3, @sentry/node 7.120.4, plus npm audit fix
• Production advisories across the stack: 42 → 9 (critical 3 → 0, high 22 → 2). Both remaining highs are profusion's lodash.set, which has no fix; the prototype-pollution test in test(HNT-3494): add file upload integration test #390 shows it isn't reachable.

I'd love feedback/perspectives on:

• The two-line request.http ??= in gateway.ts. profusion calls willSendRequest before request.http exists, which crashed header forwarding for uploads. The upload test from test(HNT-3494): add file upload integration test #390 caught it.

Implementation Decisions

• applyMiddleware used to provide the /.well-known/apollo/server-health endpoint (used by the ECS and ALB health checks), cors() and express.json(). All three are now explicit.
• Status codes are unchanged:
  • Variable coercion errors return 400 (the AS5 default, same as AS3).
  • An invalid JWT returns 400 UNAUTHENTICATED, set via extensions.http.status.
  • A missing JWT returns 500.
  • server.spec.ts pins all of these, and passes on both AS3 and AS5.
• @apollo/gateway 2.13.4 rather than 2.14.x: 2.14 pulls in OpenTelemetry packages with 13 more moderate advisories. No federation or @link changes.
• The landing page is disabled in production as before. In development it is Apollo Sandbox, because AS5 has no GraphQL Playground.

Deployment steps

• Merge after chore(HNT-3495): upgrade Node 18 to 24 #391 (Node 24) has deployed
• Dev: ECS task healthy, image upload works in the curation admin tools
• Prod: same checks; watch Sentry and the section-manager/corpus-scheduler lambdas for errors

References

JIRA ticket:

• HNT-3496 (part of HNT-1771)

Stacked on #391. Supersedes #353.