Upgrade to Backstage 1.55.3 and modernize toolchain

[kwent]

Summary

Modernizes dependencies and tooling for Backstage 1.55.3 and bumps the version to 1.4.0.

Supersedes #174 #180

Backstage

• backstage.json and the Yarn plugin moved from 1.43.3 to 1.55.3. @backstage/cli is now 0.36.6, and every @backstage/* entry in the lockfile matches the 1.55.3 release manifest.
• Explicit semver ranges stay in place of the backstage:^ protocol, because publishing uses npm publish and that would not rewrite the protocol.
• Added a @yarnpkg/core/got resolution. @yarnpkg/core@4.9.2 (pulled in by the new CLI) declares a patch: dependency on got that cannot be resolved outside the Yarn repo.
• Removed the esbuild resolution, which the Backstage CLI warns about. esbuild now resolves to 0.27.7.

package.json hygiene

• @backstage/cli and prettier are no longer runtime dependencies. They are devDependencies only.
• Removed unused packages: history, qs, install, concurrently, @spotify/prettier-config, swr, cross-fetch and @types/dom-to-image. Prettier now uses @backstage/cli/config/prettier, as in the Backstage template.
• Peer dependencies now match what Backstage 1.55 packages declare:
  • react and react-dom: ^17.0.0 || ^18.0.0
  • react-router and react-router-dom: ^6.30.2
  • The React 18 and React Router 6 dev copies are kept.
• Version updates:
  • typescript goes to ~5.8.3, the line in the Backstage 1.55.3 create-app template. Previously it was 6.0.
  • @types/node goes to 24 to match Node 24 in CI. Previously it was 26.
  • @types/react 18.3.31, @types/react-dom 18.3.7, react-router(-dom) 6.30.6 and @playwright/test 1.64.0.

Toolchain and CI

• mise.toml, .nvmrc and .node-version are set to Node 24. mise.toml and packageManager use Yarn 4.13.0.
• Actions are pinned by SHA: actions/setup-node v7.1.0, actions/checkout v7.0.1 and actions/upload-artifact v7.0.2. Checkouts use persist-credentials: false.
• publish.yml gets top-level permissions: {}, and the job keeps only contents: read and id-token: write. Publishing still uses npm OIDC trusted publishing with --provenance, with no token. A duplicate corepack enable step was removed.
• Dependabot now ignores majors Backstage cannot take: react, react-dom, @types/react*, react-router*, @material-ui/*, @mui/* and @types/node. It also ignores TypeScript minors and majors. The backstage and minor-and-patch groups are kept, and GitHub Actions updates are now grouped.

Risks

• Peer ranges are narrower. React 16 and 19 and React Router 7 are no longer declared as supported. Backstage 1.55 itself does not support them, but consumers who pinned those versions will see peer warnings. This is the reason for the minor bump.
• TypeScript is downgraded from 6.0 to 5.8 to stay in the range Backstage supports.

Verification

These all pass locally: yarn install --immutable, yarn tsc, yarn lint (52 existing warnings about React default imports, no errors), yarn test, yarn build and npm pack --dry-run.

One test in RootlyOverviewResourceCards.test.tsx can time out when Jest runs suites in parallel on a loaded machine. It fails the same way on master and passes with --runInBand.