chore(deps): drop unused dep and unship the cli

[htcom-code]

Acts on a finding recorded in the brain on 2026-08-09 that was never applied: @shadcn/react is unused, and the shadcn CLI sits in dependencies where it does not belong.

Changes

Package	Before	After	Why
@shadcn/react 0.3.0	dependencies	removed	0 imports in src
shadcn 4.18.0	dependencies	devDependencies	a CLI, never imported at runtime

@shadcn/react is not a latent need either: this project's style is base-nova, and all 12 files in src/components/ui/ import @base-ui/react subpaths (@base-ui/react/button, /select, /tabs, …) — @shadcn/react appears nowhere, so a future shadcn add will not want it back.

Effect on npm audit: 1 high → 0 in both scopes

Worth being precise about the mechanism, because it is not the dependency move:

• reinstalling shadcn under devDependencies re-resolved its own subtree and pulled js-yaml 4.3.0 → 4.3.1
• 4.3.1 is the patched release for GHSA-5p4m-2wfm-xmqj (advisory: vulnerable >= 4.0.0, < 4.3.1, first patched 4.3.1), reached through cosmiconfig's ^4.1.0 range
• so the note carried since chore(deps): bump npm production and dev groups #36 — "cannot be resolved from this repo until cosmiconfig accepts js-yaml 5.x" — is obsolete: upstream backported the fix into 4.x. A plain lock refresh on main would have cleared it too

What the move itself buys is scope correctness: a CLI is no longer in the production tree, and dependabot stops proposing it in the production group on every release (that PR noise is the other half of the 2026-08-09 finding).

Lockfile scope

• removed 1: @shadcn/react
• added 2: content-type 2.1.0, powershell-utils 0.1.0 — both nested inside the CLI's dev-only tree
• version-changed 30 — all inside shadcn's own subtree (babel 7.29.7→7.29.8, hono 4.13.0→4.13.3, jose 6.2.4→6.2.10, js-yaml 4.3.0→4.3.1, wsl-utils 0.3.1→1.0.0, browserslist/caniuse data, …). Same category as chore(deps): refresh transitive deps to clear npm audit #30's transitive refresh
• 319 packages flip from prod to dev scope with no content change — that is the CLI's tree being re-classified, which is the point of the PR
• no runtime dependency moved: the 14 packages the app actually imports (react, react-dom, @base-ui/react, @tanstack/react-virtual, lucide-react, idb, clsx, cva, tailwind-merge, tailwindcss, @tailwindcss/vite, tw-animate-css, both @fontsource-variable/*) are untouched

Verification

• npm run lint — exit 0, 3 warnings (unchanged)
• npm run build — exit 0, and dist/assets/index-*.js / index-*.css are byte-identical to main (5538909255… / de51a9a3ab…), which is the expected result of removing something nothing imported
• npm audit and npm audit --omit=dev — found 0 vulnerabilities (was 1 high in both)
• npx shadcn --version → 4.18.0, so shadcn add still works from devDependencies
• npm run dev — Vite 8.2.1 boots, http://localhost:5173/ returns 200

Observation, not addressed here

tailwindcss, @tailwindcss/vite and tw-animate-css are also build-time-only in dependencies. Nothing consumes this package as a library, so the classification has no practical effect — left alone rather than widening this PR.