chore(deps): upgrade to express 5

[Bccorb]

Supersedes #198, which was a version bump only. Express 5 broke four things here that needed real work.

What broke, and why

Every route with a query schema returned 404. Express 5 exposes req.query as a getter with no setter, and one that re-parses the URL on every read, so the assignment in defineRoute threw. That silently took out /internal/auth-events/*, /admin/auth-events, and /webauthn/register/start. The validated query is now installed as an own data property, which is also what makes the schema's coercions survive into the handler.

The default query parser moved from extended to simple, which would read a[b]=1 as the literal key a[b]. Pinned back to extended. The dashboard sends flat repeated keys (type=x&type=y) and the React SDK uses URLSearchParams, so nothing in tree depends on the difference, but an outside integrator might, and a dependency bump is the wrong place to change how query strings parse. Moving to the narrower parser stays available as a deliberate change, and is worth considering on its own: simple avoids the qs deep nesting surface.

A request with no body now arrives as undefined rather than {}. Bodies are validated as {} when absent, so a body-less request still reports its missing fields instead of one opaque "expected object, received undefined". DELETE /admin/users destructured req.body unguarded and threw a TypeError on a body-less call, so it now answers User not found. as it did before.

The SPA history fallback route no longer parsed. path-to-regexp v8 rejects a bare *, so /console/* is now the named /console/*splat. This was failing at registration time and crashing the whole adminDashboard integration file.

Types

Route params go through a new RouteRequest, since Express 5 widens req.params to string | string[] for the repeatable params this API does not use. That covers the 26 type errors without casting at each site.

Contract

No contract change. Every default Express 5 alters is pinned or restored, so no caller has to adapt and the SDKs need no coordinated release.

Verification

• npm run typecheck, npm run lint, npm run format:check: clean
• npm run test:run: 1194 passed, 1 skipped (the raw bump was 1144 passed / 43 failed)
• npm run coverage: 98.79% statements, 96.36% branches, both above threshold
• Both new tests were confirmed to fail without their fix

Noticed but not touched

Filed separately rather than folded in here: #229 (npm run build does not clean dist/), #230 (non-CORS errors answer 404 instead of 500), #231 (global rate limiters have no test coverage).