fix: align core API and banner dependency contracts

[Jacky-Pham]

The installed fetch client normalizes headers before request hooks, but the core API plugins still implement obsolete object/array branches that fail strict checking. Use the Headers contract while preserving authentication, account IDs, optional API keys, caller metadata and error redirects.

Replace DOMPurify's removed type alias with its inferred sanitizer type, add JSDOM development declarations, and extend the existing Nuxt UI alert declaration patch to accept the close-button class already forwarded at runtime. Existing runtime versions and dependency-resolution graphs are unchanged; the only new packages are @types/jsdom and @types/tough-cookie. Identical dependency patches are installed across all five frontends.

Validation:

• Fifteen actual-plugin/ofetch request cases and three actual-banner cases pass before and after. Sanitization uses DOMPurify with JSDOM, as Happy DOM is unsupported by DOMPurify. The banner test verifies the rendered dismissal style and close-button classes.
• All five standard CI workflows pass lint, 757 tests and builds on 96732d88; all 37 PR checks succeed or are intentionally skipped.
• Combined CI 35037039191, source 87d21144, passes all five lint/test/build jobs and 1,083 frontend tests.
• Paired strict diagnostics drop 405→360 standalone and 125→80 combined, with none introduced. The combined Base package now passes strict checking with zero diagnostics; other packages still fail.
• All five frozen installs pass, installed patched files match the verified source, and all pre-existing lockfile resolution and snapshot entries are preserved after updating patch hashes.

Stacked on #1827. This preserves the tested behavior while correcting dependency contracts; remaining type errors, backend lint and browser coverage still prevent full component sign-off.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud