React 19.3.0 bump is blocked by @react-three/fiber's <19.3 peer cap

## Problem

Dependabot has opened #7292 (`react` 19.2.8 → 19.3.0) and #7290 (`react-dom`
19.2.8 → 19.3.0). Both fail CI at `npm ci`, before any test runs:

```
Conflicting peer dependency: react@19.2.8
peer react@">=19 <19.3" from @react-three/fiber@9.7.0
```

`@react-three/fiber@9.7.0` is the latest stable release and caps React at
`>=19 <19.3` for both `react` and `react-dom`. That cap reflects real coupling,
not caution: r3f ships its own reconciler and depends on `scheduler@^0.27.0`,
while React 19.3.0 ships `scheduler@0.28.0`. Installing with
`--legacy-peer-deps` would put two scheduler copies under one renderer, so
forcing the resolution is not an acceptable workaround.

`@react-three/drei@10.7.8` only requires `@react-three/fiber@^9.0.0`, so it adds
no second constraint — r3f is the sole blocker.

Note for whoever picks this up: the first CI runs on both PRs showed every job
`cancelled` rather than `failed`. That is not a separate problem —
`scripts/cancel-current-ci-run.js` cancels the whole run on the first job
failure, so the same `ERESOLVE` produced both symptoms. Re-running the workflow
surfaces the real error.

## Fix

Wait for an `@react-three/fiber` release that widens its React peer range past
19.3, then:

1. Bump `@react-three/fiber` (and `@react-three/drei` if its own peer moves) in
`client/package.json`.
2. Ask Dependabot to rebase #7292 and #7290 (`@dependabot rebase`), or close
them and let it re-open against the new floor.
3. Merge `react` first, then `react-dom` — `react-dom@19.3.0` peers on
`react@^19.3.0`, so the reverse order re-introduces the same `ERESOLVE`.
4. Run the client 3D suites, which are the surface a reconciler/scheduler
mismatch would break.

Upstream tracking: https://github.com/pmndrs/react-three-fiber (peer range lives
in that package's `package.json`; `9.7.0` is current `latest`, with only
`10.0.0-canary.*` / `10.0.0-alpha.*` published beyond it).

Do not merge either PR until the peer range allows it — the install cannot
succeed.

Start with client/package.json and inspect the React, react-dom, @react-three/fiber, and @react-three/drei versions and peer ranges. Confirm the upstream @react-three/fiber release widens its React range, then rebase or reopen Dependabot PRs #7292 and #7290 in the stated order. Run npm ci and the client 3D suites; done means installation succeeds and those suites pass.

Written by the indexing model from the issue text.