fix(deps): revert TS6/ESLint10/webpack-cli7 majors and gate future majors

Three Renovate-driven major bumps that landed via `nx affected`
passing trivially (deps-only change → no project flagged as
affected) have been silently breaking the build since they merged:

- **TypeScript 5→6** (#33) — TS6 deprecates `baseUrl`; every lib's
  `tsconfig.lib.json` now fails with `TS5101: Option 'baseUrl' is
  deprecated and will stop functioning in TypeScript 7.0`. Revert
  to TypeScript 5.9.x; we'll revisit when the broader Angular/Nx
  ecosystem aligns on TS6.
- **ESLint 9→10** (#36) — `@nx/eslint@22.7.1` was built against
  ESLint 9 and fails project-graph extraction with `Unable to find
  eslint`. Revert to ESLint 9.x; bring `@eslint/js`,
  `eslint-plugin-playwright`, and `jsonc-eslint-parser` back to
  their ESLint-9-compatible versions in the same revert.
- **webpack-cli 5→7** (#34) — webpack-cli 7 removed the
  `--node-env=production` flag that Nx's webpack target generates,
  breaking `portal-bff:build`. Revert to webpack-cli 5.x; revisit
  when Nx's webpack executor is updated.

The `ajv@<8.18.0` override added in #42 was over-broad: it forced
ESLint's transitively-bundled ajv to v8, which doesn't accept the
legacy options ESLint 9 passes. Narrow the override to
`@angular-devkit/core>ajv@<8.18.0` so only the targeted chain
(nestjs-prisma > @angular-devkit/core > ajv) is bumped, leaving
ESLint's ajv alone.

Verified locally: `pnpm exec nx run-many -t lint test build` is
green on all 8 projects; `pnpm audit --audit-level=moderate`
reports zero vulnerabilities.

To prevent future silent breakages, add a Renovate package rule
that gates **all major updates** behind the dependency dashboard
(`dependencyDashboardApproval: true`). Renovate stops creating PRs
for majors automatically — they appear as checkboxes in the
dashboard, and only get a PR when a human ticks the box. Patch
and minor bumps still flow on the daily cron.

`docs/development.md` "Reviewing Renovate PRs" is updated to
explain the gate and why it exists, citing the three offenders we
caught the hard way.

package.json

@@ -33,7 +33,7 @@
     ],
     "overrides": {
       "axios@<1.15.2": ">=1.15.2",
-      "ajv@<8.18.0": ">=8.18.0",
+      "@angular-devkit/core>ajv@<8.18.0": ">=8.18.0",
       "brace-expansion@<5.0.5": ">=5.0.5",
       "follow-redirects@<1.16.0": ">=1.16.0",
       "ip-address@<10.1.1": ">=10.1.1",
@@ -55,7 +55,7 @@
     "@angular/language-service": "~21.2.0",
     "@commitlint/cli": "^20.5.3",
     "@commitlint/config-conventional": "^20.5.3",
-    "@eslint/js": "^10.0.0",
+    "@eslint/js": "^9.8.0",
     "@lhci/cli": "^0.15.1",
     "@nestjs/schematics": "^11.0.0",
     "@nestjs/testing": "^11.0.0",
@@ -85,15 +85,15 @@
     "@vitest/coverage-v8": "~4.1.0",
     "@vitest/ui": "~4.1.0",
     "angular-eslint": "^21.2.0",
-    "eslint": "^10.0.0",
+    "eslint": "^9.8.0",
     "eslint-config-prettier": "^10.0.0",
-    "eslint-plugin-playwright": "^2.0.0",
+    "eslint-plugin-playwright": "^1.6.2",
     "husky": "^9.1.7",
     "jest": "^30.0.2",
     "jest-environment-node": "^30.0.2",
     "jest-util": "^30.0.2",
     "jsdom": "^29.0.0",
-    "jsonc-eslint-parser": "^3.0.0",
+    "jsonc-eslint-parser": "^2.1.0",
     "lint-staged": "^17.0.0",
     "nx": "22.7.1",
     "postcss": "^8.5.12",
@@ -103,11 +103,11 @@
     "ts-jest": "^29.4.0",
     "ts-node": "10.9.2",
     "tslib": "^2.3.0",
-    "typescript": "~6.0.0",
+    "typescript": "~5.9.2",
     "typescript-eslint": "^8.40.0",
     "vite": "^8.0.0",
     "vitest": "^4.0.8",
-    "webpack-cli": "^7.0.0"
+    "webpack-cli": "^5.1.4"
   },
   "dependencies": {
     "@angular/common": "~21.2.0",