Modernize build tooling and add PR CI

[bgar324]

Scope

First modernization phase: replace obsolete build/test tooling without upgrading the site's UI framework versions or changing its design, roster, hosting, or branch protection.

Changes

• Replace Create React App/react-scripts and native node-sass with Vite 8.3.0, Dart Sass 1.104.0, and Vitest 5.0.0/jsdom 30.0.1. Pin supported Node 24.21.0 in .nvmrc and engines.
• Preserve the previously deployed React 16.13.1, React DOM 16.13.1, React Router 5.2.0, Bootstrap 4.5.2, React Bootstrap 1.3.0, react-ga, and react-icons versions. Configure classic JSX for React 16.13.
• Remove unused react-dropdown/react-router-bootstrap dependencies, declare directly imported dependencies explicitly, update build-only Prettier/gh-pages, and regenerate the lockfile without force/legacy-peer-deps overrides.
• Move the HTML entry to the project root, retain GitHub Pages route restoration, convert client asset requires and the image generator to native ESM imports, and port all ten regression tests to Vitest. Node image scripts remain CommonJS.
• Preserve all existing public static/media filenames and bytes, including shared PDF/map links. Assets stay external rather than being inlined into JavaScript.
• Retain CSS prefixing and move the Google Fonts stylesheet from CSS @import into HTML. This fixes a WebKit unstyled startup transition found during comparison.

CI and deployment

• New PR workflow: npm ci → npm test → npm run build, including the existing prebuild image checks. Read-only permissions, no deployment secrets, cancellation of superseded PR runs.
• Master deployment: install → tests → production build → publish build/ to gh-pages. The deployment PAT is available only to the publishing step, not build tools.
• Official checkout/setup-node actions are SHA-pinned; both workflows use .nvmrc and npm caching.
• Existing DEPLOY_ACCESS_TOKEN and GOOGLE_ANALYTICS_TRACKING_ID secret names are unchanged. The frontend build variable becomes VITE_GOOGLE_ANALYTICS_TRACKING_ID.
• The CI job is named verify. Existing branch-protection settings are not changed. PRs do not deploy.

Verification

• Clean npm ci passes on Node 24.21.0; 193 packages installed versus the previous 1,724-package installation.
• All 10 migrated tests pass. Image checks pass for 59 sources / 86 variants; regeneration reports 59 unchanged sources.
• Production builds pass with and without a dummy analytics ID. Latest local Vite production build completed in about 0.8 seconds; first-party JavaScript remains about 100 KB gzip.
• npm audit currently reports zero vulnerabilities for this new lockfile. This is not a claim about the still-unmerged default-branch dependency graph.
• All 102 emitted binary asset URLs AND SHA-256 hashes match the preserved CRA build. CNAME and 404.html are byte-identical.
• 34 Firefox and 34 WebKit checks pass: all 13 routes compared at 320px and 1440px for content, links, image order, and representative layout geometry, plus mobile navigation/hash/history, image scrolling, keyboard video activation, and local linked assets.
• JSX hot refresh was exercised with a temporary edit and restoration, without a document reload or browser errors; the probe was removed.
• Real analytics.js processing was exercised with a dummy ID and intercepted hit transport: one tracker/vendor load, correct pageviews and click attribution, no collector requests.
• gh-pages 6.3 published successfully to a local bare Git repository; its index.html, CNAME, and 404.html match build/ exactly. No production publish performed.
• Independent build/runtime and CI/security reviews approved.

Remaining deliberate follow-ups

Bootstrap 4 and existing Sass imports produce deprecation warnings. Those warnings are not suppressed; runtime/UI-library upgrades remain a separate phase. No hosting migration or automatic merge is included. The unrelated src/image.png remains untouched.

[bgar324]

The new CI workflow has now run successfully on GitHub for ff40274: checkout, pinned Node setup, npm ci, tests, and the production build all passed. Run: https://github.com/exploretech-la/website/actions/runs/34562110611 . This was a pull_request run; it did not publish or deploy the site.

[bgar324]

Follow-up 636e51e denies both optional watcher source-build hooks. Clean npm ci, all 10 tests, image checks, production build, and cold Vite startup/hot refresh pass using prebuilt packages. The cold-start check also found and fixed the React plugin adding nonexistent automatic JSX-runtime dependencies for React 16.13: both dependency scanning and app transforms now use classic JSX, and only those invalid optimizer-only entries are removed. No runtime upgrade or fake module shim was added. The README documents both decisions. The new Linux CI run passed: https://github.com/exploretech-la/website/actions/runs/34563420508