Astro 7: the demo was the last thing still on Astro 5

npm audit had one critical finding here (the Astro 5 advisories, among
them the AVIF RCE) — irrelevant at runtime for a static site served by
nginx, but the build toolchain ran it. Now 0.

Build image node 20 -> 22, and npm ci only: the old '|| npm install'
fallback meant a broken lockfile would silently build something untested.

Checked in a real browser: all six pages 200, sheet drawn, PDF download
measures 210.00 x 297.00 mm in both languages, no horizontal scroll at
390 px.

package.json

@@ -10,9 +10,9 @@
     "preview": "astro preview"
   },
   "dependencies": {
-    "@fontsource/space-grotesk": "^5.1.0",
-    "@fontsource/space-mono": "^5.1.0",
-    "astro": "^5.5.0",
+    "@fontsource/space-grotesk": "^5.3.0",
+    "@fontsource/space-mono": "^5.3.0",
+    "astro": "^7.3.8",
     "pdf-lib": "^1.17.1"
   }
 }