Bump dependency versions

Raise every caret range to the current latest within its major, in the
root package.json, the pnpm-workspace.yaml catalog, the per-package
package.json files and the create plugin template.

Majors taken: eslint 10, @eslint/js 10, globals 17, nyc 18,
@types/express 5, @types/node 24, finalhandler 2, pidusage 4,
style-loader 4, css-loader 7, yargs 18 (all packages), chalk 6.

Majors skipped: mocha 12 (integration suite fails under it, 59 tests,
starting with a 30 s timeout in clusteriocontroller run; kept at
^11.8.0), inquirer (10+ is a rewrite on @inquirer/prompts where
ui.Prompt.prototype.close no longer exists, so the win32 readline
workaround in create.js would have to go and cannot be verified here),
react/antd/react-router-dom/@types/react, typescript 7,
@sinclair/typebox, webpack-merge (exact pin), webpack-dev-middleware,
webpack-manifest-plugin, winston-daily-rotate-file.

Code adaptations: the two /api/stream/:id handlers in routes.ts are
typed Request<{ id: string }> because @types/express 5 types
req.params values as string | string[]; eslint.config.mjs adds
newIsCapExceptions: ["constructor"] because eslint 10.10 new-cap now
reports `new this.constructor()`.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

packages/controller/src/routes.ts

@@ -349,7 +349,7 @@ export async function createProxyStream(app: Application): Promise<ProxyStream>
 	return stream;
 }
 
-async function putStream(req: Request, res: Response) {
+async function putStream(req: Request<{ id: string }>, res: Response) {
 	const stream = req.app.locals.streams.get(req.params.id);
 	if (!stream || stream.source) {
 		res.sendStatus(404);
@@ -388,7 +388,7 @@ function startStream(res: Response, stream: ProxyStream) {
 	clearTimeout(stream.timeout);
 }
 
-async function getStream(req: Request, res: Response) {
+async function getStream(req: Request<{ id: string }>, res: Response) {
 	const stream = req.app.locals.streams.get(req.params.id);
 	if (!stream || stream.flowing) {
 		res.sendStatus(404);
@@ -695,8 +695,12 @@ export function addRouteHandlers(app: Application) {
 		validateHostToken,
 		(req:Request, res:Response, next:any) => uploadExport(req, res).catch(next)
 	);
-	app.put("/api/stream/:id", (req:Request, res:Response, next:any) => putStream(req, res).catch(next));
-	app.get("/api/stream/:id", (req:Request, res:Response, next:any) => getStream(req, res).catch(next));
+	app.put("/api/stream/:id",
+		(req:Request<{ id: string }>, res:Response, next:any) => putStream(req, res).catch(next)
+	);
+	app.get("/api/stream/:id",
+		(req:Request<{ id: string }>, res:Response, next:any) => getStream(req, res).catch(next)
+	);
 	app.post("/api/upload-save",
 		validateUserToken,
 		(req:Request, res:Response, next:any) => uploadSave(req, res).catch(next)