chore(deps): integrate security and Effect v4 RC upgrades

[kattsushi]

Requested outcome

Integrate the approved dependency security batches and migrate the workspace to Effect 4.0.0-rc.111 with TypeScript 7.

Current risk

origin/dev reports 5 critical, 99 high, 91 moderate, and 16 low audit findings.

Scope

• Critical web/auth upgrades
• Hatchet SDK 1.28.2
• Prisma 7.9.1
• Astro 7 and Starlight
• Nx 23.1.1
• Effect 4.0.0-rc.111 and the official TS6 API / TS7 compiler aliases

Acceptance criteria

• No critical audit findings remain.
• Workspace graph, typechecks, tests, builds, lint, and format pass.
• Published query packages retain Effect peer compatibility.
• Generated verification artifacts are not committed.
• The integrated lockfile represents all approved dependency batches.

Verified result

• Audit: 0 critical, 56 high, 57 moderate, 8 low.
• All workspace typechecks, tests, builds, lint, and format checks passed.
• The docs build produced 53 pages.
• Prisma generation completed with Prisma 7.9.1.
• React and Solid query package dry runs retained Effect as a peer dependency.

Delivery note

The individual work units and the cumulative integration were reviewed separately. A single integrated PR has an explicitly approved size:exception because the dependency lockfile and coordinated Effect/TypeScript migration must be validated as one final graph.

[kattsushi]

Completed by merged PR #153. The cumulative audit reached zero critical findings and all workspace validation passed.