chore(deps): bump the npm minor/patch group across 44 packages

Rebuilt from #1251 so the group can actually merge: same 45 bumps minus
epg-parser, plus the one-line tsconfig fix the group needs, with the lockfile
regenerated on top of the transitive-CVE overrides that landed in #1258. The
overrides were re-checked afterwards — none of them stopped applying.

This also carries axios 1.16.0 -> 1.18.1, which closes seven runtime-scope
advisories, and sharp 0.34.5 -> 0.35.3 for the libvips CVEs.

artplayer 5.3.0 -> 5.4.0 changed bundler: 5.3.0 was a Parcel build that exposed
`module.exports.default`, 5.4.0 is UMD and assigns `module.exports` directly.
`esModuleInterop` was only set in apps/web, so every lib compiled
`import Artplayer from 'artplayer'` down to `.default` and got `undefined` —
that is the `Cannot set properties of undefined (setting
'AUTO_PLAYBACK_TIMEOUT')` failure on #1251. Production was never affected
(esbuild resolves the ESM entry); it is a CJS/Jest interop gap, so
`esModuleInterop` moves to tsconfig.base.json where it belongs.

epg-parser ^0.1.6 -> ^0.5.0 is held back deliberately. Dependabot groups it as
a minor, but 0.x minors are breaking and this one reshapes the parse output:
`channel.name` -> `displayName`, icons/urls become objects, `credits` becomes
role-keyed, and start/stop/date switch from raw XMLTV strings to ISO. Its only
consumer is the web-backend `/parse-xml` endpoint, which has no coverage and no
caller yet, so the change belongs in its own PR next to a consumer update.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.changes/deps-npm-minor-patch-group.md

@@ -0,0 +1,9 @@
+---
+type: internal
+area: deps
+---
+
+Updated 44 dependencies, including the HTTP client behind every playlist and
+portal request — that one closes seven advisories that affect the shipped app,
+among them a proxy-credential leak on redirects. Also refreshes the ArtPlayer,
+hls.js, Video.js and Shaka player engines. No behaviour change intended.