frontend: npm dependency updates (#681)

Bumps:
- marked       4.3.0  → 18.0.4  (agent + dashboard)
- chart.js     4.4.4  → 4.5.1   (agent stats page)
- esbuild      0.25.5 → 0.28.0  (workspace devDep)

marked v18 still ships a synchronous `marked.parse(text)` + `marked.setOptions({})`,
so our `mdNode()` call sites in dashboard/common.js and agent/app.js work
unchanged. `window.marked = marked` global bridge survives the bundler.
Verified end-to-end: `** strong **`, `[link](https://…)`, bullets, fenced
code blocks all render identically to v4. Agent app.js shrank ~15kb,
dashboard tabs.js shrank ~16kb (smaller marked + tighter esbuild).

chart.js 4.5.1 is patch-bump within the 4.x line — `new Chart(el, config)`
core API unchanged. esbuild 0.28.0 builds cleanly with our existing
build.mjs configurations.

`npm audit` reports 0 vulnerabilities. nix build passes; recomputed
npmDepsHash via `prefetch-npm-deps frontend/package-lock.json`.

closes #681

frontend/packages/agent/package.json

@@ -9,7 +9,7 @@
   },
   "dependencies": {
     "@hive/shared": "*",
-    "marked": "4.3.0",
-    "chart.js": "4.4.4"
+    "marked": "18.0.4",
+    "chart.js": "4.5.1"
   }
 }