fix(web): repair broken Heap snippet, upgrade astro 6→7, clear all 20 npm alerts

[GregHolmes]

Stacked on #95 (base is chore/dependency-audit, so review that one first).

1. Heap analytics is broken in production right now 🔴

The inline Heap loader in index.astro is a JavaScript syntax error. The minified snippet ends:

...o<p.length;o++)heap[o]=n(p[o]);      // ← missing the closing `}`

The official snippet ends heap[o]=n(p[o])};. Without it, the outer heap.load=function(e,t){ is never closed — 4 { vs 3 }. So the script fails to parse, heap.load is never defined, and heap.load("765739241") on the next line never runs.

Confirmed against live production HTML, not just source:

$ curl -s https://cli.deepgram.com | ...
tail: ...o<p.length;o++)heap[o]=n(p[o]);
braces: {=4 }=3 balanced=False

So Heap has collected nothing since #76 shipped it. GA4 (a separate script block) is unaffected.

Astro 6 passed the malformed raw text through silently; astro 7's stricter compiler is what exposed it (Expected } but found EOF). I found it because the upgrade build failed.

2. astro 6 → 7 + toolchain, clearing every npm alert

package	from	to
astro	6.1.6	7.2.2 (pulls vite 8)
tailwindcss / @tailwindcss/vite	4.2.2	4.3.3
@astrojs/sitemap	3.7.2	3.7.3
sharp / svgo	—	via npm audit fix

npm audit: 20 vulnerabilities (11 high, 6 moderate, 3 low) → 0.

Verification — the upgrade is output-neutral

Diffed the astro 7 build against an astro 6 baseline of the same commit:

• Identical file set (only content-hash asset names differ; astro 7 renames the CSS pattern)
• og-image.png byte-identical — the @resvg/resvg-js native path is unaffected
• Identical structure: 654 tags, 19 links, 39 svg paths, 5 scripts, 37 headings, 5711 visible characters — all unchanged
• index.html is 1075 bytes smaller, purely astro 7 output formatting
• Advertised CLI version still resolves correctly from root pyproject.toml

Worth a look before merge

• Local build ran on Node 24; netlify.toml pins NODE_VERSION = 22. Astro 7 supports both, but a staging deploy is the real check — and staging fires automatically on merge to main.
• Production only deploys on a root v* release after PyPI publish, so this cannot ship a version-skewed page.
• Someone should confirm in Heap that data starts arriving once this deploys — and that the missing history is understood.