Vite migration (2/3): replace Create React App with Vite

Part of #1578. Depends on #1579. This step is atomic: one PR that removes the old toolchain and installs the new one, buildable and bootable on its own.

**Change.** Vite config (`ui/vite.config.mts`) preserving the output contracts (`ui/build`, `static/js`, `static/css`, `static/media`, sourcemaps, `REACT_APP_` prefix, `base` from `ui/scripts/env.js`); `package.json` and lockfile; `index.html` moved to the `ui` root; `react-scripts`, `react-app-rewired`, `customize-cra`, `config-overrides.js` and the other toolchain leftovers removed; `process.env` reads become `import.meta.env` and are typed; `require()` calls become ES imports; the router enumerates page modules with a bounded `import.meta.glob` instead of an aliased template-literal import that no bundler can analyze; the `header.html` entry script becomes `type="module" crossorigin`. Plus the two first-paint fixes: plugin i18n registration made independent of module evaluation order, and the bootstrap-icons font path resolved so the font files are actually emitted. Build-script parity: `tsc --noEmit` runs in `pnpm build`; the release workflow's Node and `engines` match the bundler's floor.

**Done when.** `pnpm install` and `pnpm build` pass on `dev` plus step 1 plus this change, `go build ./...`, `go vet ./...` and `TestGetStyleResolvesBuiltAssets` pass against the new build, no reference to the removed toolchain remains outside the lockfile, and the built binary boots with the client mounted in a browser.

**Behaviour to disclose in the PR.** The CDN/CORS consequence of module scripts (documented in apache/answer-plugins#326), the custom stylesheet href derivation, and the two pre-existing dead routes that now fail loudly instead of silently (`pages/403` is repointed in step 3).

Inizia dopo #1579 leggendo ui/vite.config.mts, ui/scripts/env.js, package.json, il lockfile e il config-overrides.js esistente. Esegui pnpm install e analizza gli attuali punti di ingresso del build e del router prima di migrare la gestione indicata dell’ambiente, degli import, dell’HTML e dei font. Il lavoro è completato quando pnpm build, go build ./..., go vet ./... e TestGetStyleResolvesBuiltAssets hanno esito positivo, il binario si avvia in un browser e non rimangono riferimenti alla toolchain rimossa al di fuori del lockfile.

Scritto dal modello di indicizzazione a partire dal testo della issue.