core-js is a devDependency but is used in production code

## Description

`core-js` is declared in `devDependencies` (`packages/graph-explorer/package.json:97`, `^3.49.0`), but it's actually consumed by production application code: `packages/graph-explorer/src/index.tsx:7` has `import "core-js/full/iterator";`, which polyfills the Iterator helpers proposal (`Iterator.prototype.map`/`filter`/`take`/`drop`/`flatMap`/etc.) and ships in the app bundle.

Since this import runs in the browser, `core-js` should be a regular `dependencies` entry, not a `devDependencies` entry — `devDependencies` are conventionally build/test-only and aren't guaranteed to be installed or resolved the same way in all consumption scenarios.

The import was added in commit `954882b3` (November 2024, #658) with no explanation of the dependency placement, so there's no known reason it was placed under `devDependencies`.

## Expected Behavior

`core-js` should be moved from `devDependencies` to `dependencies` in `packages/graph-explorer/package.json`.

---

> [!IMPORTANT]
> Internal only — this issue is maintained by the core team and is not accepting external contributions.

Start with packages/graph-explorer/package.json:97 and packages/graph-explorer/src/index.tsx:7, where the production import is shown. Check the dependency placement and confirm the browser application still resolves the import after the package metadata change; done means core-js is listed under dependencies rather than devDependencies.

Written by the indexing model from the issue text.