chore(deps): remove vulnerable analyzer templates and gate critical audits

[infeng]

The remaining npm critical audit entries come from webpack-bundle-analyzer 3's EJS templates. Upgrade the analyzer to 4.10.2, which removes the EJS dependency while retaining compatibility with the existing webpack 4 plugin configuration.

Add npm run audit:critical for both the root and SSR dependency trees, and run it in full verification and Node 22/24 CI. Critical advisories now fail the gate; the existing high/moderate/low backlog remains visible. The maintenance guide explains the live public-registry check and its scope.

Validation:

• Clean public-registry install and full npm run verify passed, including 42 viewer tests, lint, all builds, default-export and SSR hydration, multipart regression, both critical audit gates, and package dry run.
• npm audit: root has 0 critical (114 other affected packages); SSR has 0 critical (31 other affected packages).
• Ran the existing webpack 4 production configuration with ANALYZE enabled and static report options: generated a 278,944-byte report containing the index bundle and ViewerCore. Chrome 149 rendered its treemap without page errors.
• Both lockfiles contain no EJS, Babel 6 traversal, tar or retired gh-pages package; all registry URLs are public-only; git diff --check passed. Rebase retained the exact tested tree.

No library API or release version changes. EJS advisory.