frontend: npm dependency updates (#681)

Bumps:
- marked       4.3.0  → 18.0.4  (agent + dashboard)
- chart.js     4.4.4  → 4.5.1   (agent stats page)
- esbuild      0.25.5 → 0.28.0  (workspace devDep)

marked v18 still ships a synchronous `marked.parse(text)` + `marked.setOptions({})`,
so our `mdNode()` call sites in dashboard/common.js and agent/app.js work
unchanged. `window.marked = marked` global bridge survives the bundler.
Verified end-to-end: `** strong **`, `[link](https://…)`, bullets, fenced
code blocks all render identically to v4. Agent app.js shrank ~15kb,
dashboard tabs.js shrank ~16kb (smaller marked + tighter esbuild).

chart.js 4.5.1 is patch-bump within the 4.x line — `new Chart(el, config)`
core API unchanged. esbuild 0.28.0 builds cleanly with our existing
build.mjs configurations.

`npm audit` reports 0 vulnerabilities. nix build passes; recomputed
npmDepsHash via `prefetch-npm-deps frontend/package-lock.json`.

closes #681

frontend/package.json

@@ -13,6 +13,6 @@
     "clean": "rm -rf packages/*/dist"
   },
   "devDependencies": {
-    "esbuild": "0.25.5"
+    "esbuild": "0.28.0"
   }
 }