node-red-dashboard: Upgrade sharp 0.34.5 → 0.35.0 (major-class bump)

[n-lark]

Upgrade sharp 0.34.5 → 0.35.0 (major-class bump)

PR here: FlowFuse/node-red-dashboard#2179
Dependabot PR: dependabot/npm_and_yarn/sharp-0.35.0

Why this is out of the weekly batch

sharp is a 0.x package, so 0.34 → 0.35 is semver-breaking, and the release ships a long list of breaking changes. Per our Dependabot triage policy, major-class bumps get pulled out of the weekly slot and owned as their own work item.

Key breaking changes:

• Requires Node ≥ 20.9.0 (drops Node 18)
• Removes deprecated failOnError constructor property
• Renames format.jp2k → format.jp2
• Lossy AVIF output retuned (SSIMULACRA2-based quality metrics)
• Adds limitInputChannels (default 5)

Blast radius (contained)

• sharp is a direct devDependency and is not imported in shipped code — used only via build tooling.
• vite-plugin-image-optimizer@2.0.2 — peer sharp >=0.34.0, satisfied by 0.35 ✅ (this tool actually calls sharp during vite build)
• @vite-pwa/assets-generator@1.0.0 — hard-pins sharp ^0.33.5, keeps its own nested 0.33.5 (unaffected)
• CI runs Node 24, so the Node ≥20.9 requirement is already met.

What needs to be done

• Run npm run build on Node ≥20.9 and confirm optimized image output is correct (AVIF retuning can change results).
• Run npm run generate-pwa-assets and verify PWA icons/assets are clean.
• Reconcile stale engines.node: ">=14" in package.json (CI is already Node 24) — decide whether to bump the declared floor.
• Confirm CI green, then merge the Dependabot PR.