perf(npm): reduce package payload and split frontend startup

[OthmaneZ05]

Summary of Changes

This PR prepares the npm package for launch by reducing what users download, making the published runtime dependency graph explicit, and deferring frontend code that is not needed for the projects screen.

• Frontend startup: Canvas, terminal, learning catalogue/detail, learning panel, and canvas modals now load on demand. Canvas modals are mounted only while one is open, with localized accessible loading states. The initial JavaScript payload falls from 1,252 KB to 344 KB (340 KB to 109 KB gzip), and no emitted chunk exceeds Vite’s 500 KB warning threshold.
• Package contents: backend builds start from a clean dist/ and exclude unit tests, integration tests, and test helpers. The npm allowlist no longer ships nested package manifests or a nonexistent file. The tarball falls from 655 KB to 613 KB compressed, 2.23 MB to 1.94 MB unpacked, and 132 to 107 files.
• Publish safety: root build compiles backend and frontend, and prepack invokes it so npm pack and publication cannot use stale artifacts.
• Runtime dependencies: adm-zip and ajv, required by the distributed backend, are direct root dependencies. Unused direct chokidar is removed; @types/adm-zip moves to backend development dependencies; the backend package is private.
• Dependency hygiene: audited lockfiles are refreshed, including the Dockerode 5.0.1 patch.

Types of Changes

• New feature / node type addition
• Bug fix (non-breaking change resolving an issue)
• Refactoring / structural cleanup
• Documentation update

Verification & Testing

Automated Checks

• Run npm run lint successfully with no errors (backend clean; frontend: 0 errors and 5 pre-existing warnings in untouched files)
• Run npm run build successfully with no compilation errors (backend and frontend)
• Run npm test successfully: root 32, backend 509, frontend 371
• Run npm audit successfully with 0 vulnerabilities in root, backend, and frontend

Manual Verification

• Built and installed the packed tarball in an isolated directory: torollo --help runs, the distributed backend resolves adm-zip and ajv, and no compiled test files or nested package manifests are present.
• Served the production frontend locally: the Projects screen loads its small entry chunk first; clicking Learning fetches the Learning chunk and its dependencies on demand.
• Confirmed the published backend output contains 61 JavaScript files (down from 107) after the clean build.

Checklist

• My code follows the repository’s code style and lint standards
• I have updated the documentation or instructions if necessary
• All unit and integration tests are passing