Frontend node modernization / Beige Screen fix

[CoryMCodes]

Summary

Two related changes to the Ember frontend: it now installs and builds on modern Node
(18+, pinned at 22), and .env values reach a cold build, which fixes the blank beige
screen on first load.

Modern Node support (Fixes CI front end builds)

frontend/package.json pinned node 14.x / npm 6.x with engine-strict=true, so a plain
npm install failed outright on any current Node. npm 6 also refuses to run lifecycle scripts
as root, which silently skipped postinstall (patch-package and bower install) while still
exiting 0 — the reason --unsafe-perm kept coming back. npm 7 dropped that privilege-dropping
behaviour, so moving off npm 6 removes the need for the flag rather than working around it.

• engines is now node: >=18, dropping the npm and bower pins
• frontend/.nvmrc and frontend/.tool-versions (and root .tool-versions) to Node 22,
  matching the image and CI
• package-lock.json converted to lockfileVersion 3, which enables npm ci. This is the bulk
  of the diff — a format conversion, not a dependency bump.
• frontend/Dockerfile on node:22-bookworm using npm ci; drops the npm@6 pin and the
  OPENSSL_CONF=/dev/null workaround, neither of which is needed now
• CI reads frontend/.nvmrc for the main job; the matrix job tests 18, 20 and 24 to guard the
  engines range
• allow_root in .bowerrc, so installs need no flags in root containers

Blank beige screen on cold load Fixes #719

.env values never reached a cold build. ember-cli-build.js pointed ember-cli-dotenv at
../backend/.env, a path that does not exist in the frontend container at all, and ember-cli
evaluates config/environment.js before addon config hooks run. The first build therefore
produced a config with no FACEBOOK_APP_ID, PUSHER_KEY or RECAPTCHA_SITE_KEY, while any
rebuild picked them up — which is why editing config/environment.js and refreshing appeared
to fix it.

• config/environment.js now loads frontend/.env itself, at the top of the file, before the
  config is built; ember-cli-dotenv is replaced by dotenv directly
• Fixes two pre-existing no-redeclare lint errors (var STATIC_URL) in the same file
• Drops the console.log(process.env.FACEBOOK_APP_ID) workaround from README "Common Problems"

Docs

Rewrote the frontend setup instructions in README.md and frontend/README.md (Node
requirement, cp env-example .env, npm install vs npm ci, npm run dev, no
sudo/--unsafe-perm) and updated the CLAUDE.md gotchas. FACEBOOK_APP_ID is now
documented as only being needed for Facebook login.

Testing

• Fresh install and build checked on Node 14, 18, 22 and 24 — 14 stops at the engine check, as
  intended
• Clean-clone npm install, dev server, and npm ci as root on Node 18, all with no extra flags
• npm install is idempotent against the committed lockfile, so a first install no longer
  leaves a dirty working tree
• Not run locally: the Docker image build and npm test. Relying on CI for both.