Update Angular to 22

[four-random-common-words]

Updates Angular from 21 to 22. Stacked on #841, review that one first.

Manual test plan: docs/manual-tests/angular-22-upgrade.md

Changes

• @angular/*, CLI / build and Material / CDK 22.2.1, @angular-eslint/* 22.5.0
• TypeScript 5.9 -> 6.0.3. Angular 22 requires >=6.0 <6.1; TypeScript 7 does not ship the compiler API Angular builds on yet
• @fortawesome/angular-fontawesome 4 -> 5 (Angular 22 support only), @ng-idle/* 13 -> 16 (no API changes), @types/node 20 -> 24 to match the runtime
• ng update migrations, committed untouched in their own commit:
  • Components without a change detection strategy now default to OnPush; the migration pins the existing ones to ChangeDetectionStrategy.Eager (151 files), so nothing changes at runtime
  • HttpClient now defaults to the fetch backend. app.module.ts keeps XHR with withXhr(): the fetch backend buffers responseType: 'blob' bodies in JS memory, which would break downloading large wordlists through getFile(). The withXhr() the migration added to specs is removed again, the testing backend replaces it there
  • ?. in templates now returns undefined instead of null. The one affected expression (hashtype field on the edit hashlist page) is rewritten to show nothing while loading instead of "null - null"
  • istanbul-lib-instrument added for Karma coverage
• Removed baseUrl from tsconfig.json (an error in TypeScript 6 and 7): 38 imports of the form 'src/...' now use the @src/... alias. The tsconfigs also type-check cleanly with TypeScript 7
• The root tsconfig.json is limited to src. Before, check-types also compiled dist/ and coverage/ (allowJs), and a minified build chunk declaring a global it broke every spec
• angular-eslint 22 dropped the eslintrc configs: eslint.config.mjs now uses the flat configs of the angular-eslint package. Its new prefer-on-push-component-change-detection rule is off, since the components are deliberately pinned to Eager
• Removed deprecated or unused packages and APIs:
  • @angular/animations and BrowserAnimationsModule (deprecated, removal planned for 23). Material animates with CSS; specs that used NoopAnimationsModule now disable Material's animations through MATERIAL_ANIMATIONS
  • @angular/platform-browser-dynamic: bootstrap and tests use platformBrowser / platformBrowserTesting. This also drops the JIT compiler from the production bundle
  • @angular/localize (no i18n or $localize usage)
  • HttpClientTestingModule and RouterTestingModule in specs
  • the stale @angular-devkit/build-angular Karma framework entry and the unused isHttpProgressEvent helper
• FormConfigComponent gets its own selector app-form-config; it shared app-form with FormComponent, which Angular 22 rejects as soon as both match an element

Notes

• Versions are 22.2.1 / 22.5.0 instead of the latest 22.2.3 / 22.6.0 because of the 14 day min-release-age in .npmrc. The caret ranges pick up newer patches once they are old enough.
• Lockfile changes outside the Angular toolchain: the new CLI drops and replaces a number of its own dependencies, and zod 4.4.3 -> 4.6.5 because the CLI requires the newer version.
• Router paramsInheritanceStrategy now defaults to 'always'. Every parent route in the app is componentless, so routes already inherited params and data; nothing changes.
• Lint problems: 98, down from 172 on Update Angular to 21 #841, none new. lint:tokens still reports edit-tasks.component.html:142, unchanged by this PR.
• Production build: initial chunks 14 -> 5 files (chunk optimization is on by default in CLI 22), +2 kB transferred; lazy chunks unchanged.

Testing

• Unit tests: 1837 pass, 0 fail
• check-types and production build pass
• Manual test plan not run yet