Approve the pinned UI stack after independent clean build checks

Changes: Accept ADR 0001 for the bounded React/TypeScript/Vite and Node/npm choice; record independent security findings and update S00-002 handoff. Preserve browser interaction and release/interoperability limits.
Validation: Fresh-cache npm ci and strict npm run build passed on Node 24.21.0/npm 11.19.0; lock and artifact SHA256 matched executor evidence. Verified exact pins, 67 locked license/integrity entries and installed runtime license notices. HTTP preview matched built HTML/JS; make check passed 72 tooling tests; scoped diff and whitespace checked. No DOM interaction, vulnerability/provenance or product readiness acceptance is claimed.