frontend: npm dependency updates (#681)

Bumps:
- marked       4.3.0  → 18.0.4  (agent + dashboard)
- chart.js     4.4.4  → 4.5.1   (agent stats page)
- esbuild      0.25.5 → 0.28.0  (workspace devDep)

marked v18 still ships a synchronous `marked.parse(text)` + `marked.setOptions({})`,
so our `mdNode()` call sites in dashboard/common.js and agent/app.js work
unchanged. `window.marked = marked` global bridge survives the bundler.
Verified end-to-end: `** strong **`, `[link](https://…)`, bullets, fenced
code blocks all render identically to v4. Agent app.js shrank ~15kb,
dashboard tabs.js shrank ~16kb (smaller marked + tighter esbuild).

chart.js 4.5.1 is patch-bump within the 4.x line — `new Chart(el, config)`
core API unchanged. esbuild 0.28.0 builds cleanly with our existing
build.mjs configurations.

`npm audit` reports 0 vulnerabilities. nix build passes; recomputed
npmDepsHash via `prefetch-npm-deps frontend/package-lock.json`.

closes #681

nix/frontend.nix

@@ -37,7 +37,7 @@ buildNpmPackage {
   # Update whenever the lockfile changes. Recompute locally with the
   # same command (`pkgs.prefetch-npm-deps`), or let the build fail
   # and copy the actual hash from the error message.
-  npmDepsHash = "sha256-MHXxkZpe/5LAhpQ76ZK94znG2noTobthjUi6iNY8/K4=";
+  npmDepsHash = "sha256-3pBR4YDE/ZQ9w7wzIwdGL/n6VSKRtM0m+7ftu1uUOdE=";
 
   # `npm run build` recurses into all workspaces (`--workspaces
   # --if-present`). The workspaces' build scripts each run their own