Security: update the vulnerable xlsx dependency

## Current evidence

The current default branch still declares `xlsx`:

- `packages/MJExplorer/package.json`: `dependencies.xlsx = ^0.18.5`

GitHub's current dependency data resolves the affected release/range as `0.18.5`, `^0.18.5`.
These releases are covered by two published high-severity advisories:

- [GHSA-4r6h-8v6p-xvw6](https://github.com/advisories/GHSA-4r6h-8v6p-xvw6) - prototype pollution
- [GHSA-5pgg-2g8v-p4x9](https://github.com/advisories/GHSA-5pgg-2g8v-p4x9) - regular expression denial of service

## Remediation paths

The official SheetJS distribution currently recommends the patched `0.20.3`
tarball: [SheetJS Node installation](https://docs.sheetjs.com/docs/getting-started/installation/nodejs/).

For projects that prefer an npm-registry dependency, the module name and imports
can be preserved with this alias:

```json
"xlsx": "npm:@stackline/xlsx@^1.0.6"
```

The current CI/version files use Node 24. `@stackline/xlsx@1.0.6` requires Node 20 or newer and has no
runtime dependencies, so that option should only be used if the project's Node
support contract permits it. Existing imports from `xlsx` remain unchanged.

Disclosure: I maintain `@stackline/xlsx`, an independent Apache-2.0 SheetJS
fork. I am mentioning both the official SheetJS remediation and our npm option
so the project can choose the path that best matches its release policy.

I can prepare a focused, tested pull request if the maintainers would find that
useful.

Start with packages/MJExplorer/package.json and inspect the current Node 24 CI/version files before choosing between the official SheetJS tarball and the npm alias. Confirm the selected option fits the project's Node support contract, then verify that the vulnerable xlsx range is removed and the existing package usage still works.

Written by the indexing model from the issue text.