[mikehelmick]

Stacked on #303 → #304. Merge those first; the change here is the last commit, content-moderator, saas-tracker: AppKit 0.40 -> 0.91.3; build without their tables.

Summary

Moves content-moderator and saas-tracker from AppKit 0.40.0 to 0.91.3. These two were left behind when the other AppKit templates moved to 0.87 (#287), because a fresh deploy couldn't build:

• Their analytics queries read UC catalogs over Lakebase tables that the app creates on first start (content_moderation.content_moderation.*, saas_tracker.saas_tracker.*).
• prebuild ran appkit generate-types --wait (blocking mode). There, a missing table is a SQL error, and AppKit always fails the build on SQL errors, with no fallback to committed types.

Changes

• prebuild runs typegen non-blocking (--wait removed). Non-blocking typegen never queries the warehouse at build time. predev still generates real types locally once the tables exist.
• AnalyticsPage.tsx declares its overview row type (ContentOverviewRow, SpendOverviewRow) and casts the hook's data to it. The client then compiles whether the generated result type is real or degraded (unknown).
• AppKit 0.40.0 → 0.91.3, with zod aligned to AppKit's 4.6.7. Leaving it at 4.1.13 produced a nested copy that broke postinstall.
• Direct dependencies brought up to the same level as the other AppKit templates. These two missed npm templates: direct dependency bumps (OTel 2.x, jest 30, react-router, sharp) — 0 criticals #282 and npm templates: refresh dependencies, clear critical/high advisories #299 while they were held back, so they carried 1 critical (vitest) and 3 high (react-router, sharp) findings. They get the same rules: minor/patch only, patch-only for 0.x, a 7-day cooldown, and sharp 0.35.5 to match the siblings. They also get AppKit templates: clear the last npm audit moderates (minimatch) #304's scoped minimatch override. AppKit 0.91.3 already fixes echarts, yaml and qs, so no overrides are needed for those.
• package-lock.json is now committed, as for every other npm template. Neither app had one before.

Validation

• npm audit: 1 critical / 3 high / 6 moderate → 0 findings in each. A plain npm ci passes, and the lockfiles use only registry.npmjs.org URLs.
• npm run build with no warehouse configured (so no tables) succeeds in both. That's exactly what failed before.
• On the shared template-e2e-test app (rerun on 0.91.3 across all 12 AppKit templates: force-build 12/12, deploy 12/12):

  --val-force-build  validate_templates.py::test_validate_template[content-moderator] PASSED
  --val-force-build  validate_templates.py::test_validate_template[saas-tracker] PASSED
  deploy + serve     validate_templates.py::test_validate_template[content-moderator] PASSED
  deploy + serve     validate_templates.py::test_validate_template[saas-tracker] PASSED
  

Follow-up: .github/dependabot.yml doesn't list these two directories. Now that they have lockfiles, they can be added.

This pull request and its description were written by Isaac.