Dependencies current: npm audit 0 (was 7, six of them high)

nodemailer and basic-ftp are only fixed in their next major, so this
takes both, along with argon2 0.45, ssh2-sftp-client 12, archiver 8,
@astrojs/react 7 and the minor bumps.

- archiver 8 has no default export any more, only `ZipArchive`. Our own
  `src/types/archiver.d.ts` still declared the old default, so `tsc` would
  have stayed green while every ZIP download threw at runtime. The local
  declaration is gone; `@types/archiver` 8 matches the real API now.
- nodemailer 10 ships its own types; `@types/nodemailer` is gone.
- Existing argon2 hashes still verify (hash made with 0.41, verified
  with 0.45).
- basic-ftp 6 no longer silently redirects the data connection when an
  FTP server behind NAT announces its private address. That is the
  library's deliberate secure default. If a delivery target that worked
  before fails now, press "Test connection" — the error names the cause.
- `baseUrl` is out of tsconfig.json (TypeScript 7 removed it; the `@/`
  alias was never used).
- engines: Node >= 22.12, which pg-boss and @astrojs/react now require.

Deliberately not taken: pg-boss 12 cannot migrate the v10 queue schema
in place, and TypeScript 7 is a toolchain switch with no security gain.
Both get their own change.

tsconfig.json

@@ -2,12 +2,6 @@
   "extends": "astro/tsconfigs/strict",
   "compilerOptions": {
     "jsx": "react-jsx",
-    "baseUrl": ".",
-    "paths": {
-      "@/*": [
-        "src/*"
-      ]
-    },
     "esModuleInterop": true,
     "allowSyntheticDefaultImports": true,
     "types": [