node-red-dashboard: Upgrade sharp 0.34.5 → 0.35.0 (major-class bump)

# Upgrade sharp 0.34.5 → 0.35.0 (major-class bump)

PR here: https://github.com/FlowFuse/node-red-dashboard/pull/2179
Dependabot PR: `dependabot/npm_and_yarn/sharp-0.35.0`

## Why this is out of the weekly batch

`sharp` is a `0.x` package, so `0.34 → 0.35` is **semver-breaking**, and the release ships a long list of breaking changes. Per our Dependabot triage policy, major-class bumps get pulled out of the weekly slot and owned as their own work item.

Key breaking changes:
- **Requires Node ≥ 20.9.0** (drops Node 18)
- Removes deprecated `failOnError` constructor property
- Renames `format.jp2k` → `format.jp2`
- Lossy AVIF output retuned (SSIMULACRA2-based quality metrics)
- Adds `limitInputChannels` (default 5)

## Blast radius (contained)

- `sharp` is a **direct devDependency** and is **not imported in shipped code** — used only via build tooling.
- `vite-plugin-image-optimizer@2.0.2` — peer `sharp >=0.34.0`, **satisfied by 0.35** ✅ (this tool actually calls sharp during `vite build`)
- `@vite-pwa/assets-generator@1.0.0` — hard-pins `sharp ^0.33.5`, keeps its own nested 0.33.5 (unaffected)
- CI runs **Node 24**, so the Node ≥20.9 requirement is already met.

## What needs to be done

- [ ] Run `npm run build` on Node ≥20.9 and confirm optimized image output is correct (AVIF retuning can change results).
- [ ] Run `npm run generate-pwa-assets` and verify PWA icons/assets are clean.
- [ ] Reconcile stale `engines.node: ">=14"` in `package.json` (CI is already Node 24) — decide whether to bump the declared floor.
- [ ] Confirm CI green, then merge the Dependabot PR.

Start with the Dependabot PR and package.json, then run npm run build and npm run generate-pwa-assets on Node 20.9 or newer. Check the optimized images and generated PWA assets, review the engines.node decision, and confirm CI is green before the dependency PR is merged.

Written by the indexing model from the issue text.