Bug report: Local dev builds fail on Windows

## Summary

CyberChef's local dev workflow is tuned to Linux/macOS (DevContainers). On Windows, `npm install` works, but `npm run build`, `npm test`, `npm start`, and `npm run testnodeconsumer` all fail. The root cause is that several `Gruntfile.js` tasks and `package.json` scripts shell out to Unix-only utilities and use shell syntax that `cmd.exe` doesn't understand. A few `webpack.config.js` regexes also assume `/` path separators.

## Environment

- OS: Windows 10/11 (PowerShell or cmd.exe)
- Node: v24.x
- npm: 11.x

## Steps to reproduce

1. Clone the repo on a Windows machine.
2. Run `npm install` — succeeds.
3. Run any of `npm run build`, `npm test`, `npm start`, `npm run testnodeconsumer`, `npm run getheapsize`, `npm run minor`, or `npm run tag`.

Expected: the script runs to completion, same as on macOS/Linux.
Actual: the script fails (details below).

## Issues

### 1. `npm run build` — 7 webpack errors from path-separator regexes

[webpack.config.js](webpack.config.js) has three regex `test`/`exclude` patterns that use literal `/` separators. Webpack 5 matches these against the module's absolute file path, which uses `\` on Windows, so they silently fail to match.

This produces two classes of error:

- **jimp babel-loader conflict** — `Module parse failed: Identifier 'e' has already been declared`. Babel transforms jimp's pre-minified browser bundle because the `node_modules/(?!crypto-api|bootstrap)` exclude doesn't fire.
- **Asset Modules Plugin — invalid generator** — `generator has an unknown property 'filename'` on `asset/inline`. First-party images in `src/web/static/` match both the `asset/resource` and `asset/inline` rules because the `exclude: /web\/static/` doesn't fire.

### 2. `npm test` / `npm run build` — Grunt tasks shell out to Unix utilities

Several [Gruntfile.js](Gruntfile.js) `exec` tasks use commands that don't exist on Windows or use shell syntax `cmd.exe` doesn't support.

A leftover `chainCommands()` helper exists in `Gruntfile.js` hinting at Windows awareness, but it has no call sites and the underlying commands have no Windows branch.

### 3. `package.json` scripts use Unix-only shell syntax

- **`setheapsize`** — `export NODE_OPTIONS=…`. `export` isn't a `cmd.exe` builtin. (Also a no-op on every platform, since the variable dies with the subshell.)
- **`getheapsize`** — `node -e '…single-quoted JS…'`. cmd.exe doesn't strip single quotes, so the JS string is passed through with literal quotes and fails to parse.
- **`minor`** and **`tag`** — both use `$(npm pkg get version | xargs)`. `$(…)` subshells don't work in cmd.exe, and `xargs` doesn't exist there.

## Scope

Local dev only. CI is pinned to `ubuntu-latest` and is unaffected.

## Suggested fix direction

Inline the shell commands as Node.js. The regex fixes can replace `\/` with `[/\\]` to match both separators — `/` still matches via the character class on macOS/Linux, so there's no behavior change there.