John's decision: DOMPurify to 2.5.x and Vuetify to the latest 2.x (2.6.16 as the fallback if 2.7 does not build on Node 12.22.9), as an exception to the front-end dependency rule, each proven by a full client build and Cypress. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>