chore: migrate backend to Express 5

[Inmerson]

Summary

• Migrates the backend from Express 4 to Express 5.2.1 and @types/express 5.0.6.
• Resolves the remaining qs advisory by locking the Express 5 dependency graph to qs 6.16.0.
• Preserves existing validation semantics for bodyless POSTs under Express 5.
• Handles EADDRINUSE startup failures explicitly instead of printing false startup-success messages.
• Strengthens test-api.js into an enforceable smoke/regression gate with 19 endpoint/status checks.

Verification

Fresh verification on this exact branch:

• Node 22 TypeScript build: passed.
• Live API regression suite: 19 passed, 0 failed.
• Bodyless /api/matrix/add and /api/exam/result: HTTP 400 as intended.
• Port-collision regression: second server exits code 1, failure log present, no false success log.
• npm audit --json: 0 vulnerabilities.
• npm ci --dry-run --ignore-scripts: passed.
• git diff --check: passed.
• Independent re-review: APPROVED, no remaining Critical or Important findings.
• GitHub CI: passed.

Dependency context

Dependency refresh PR #23 is merged into main. This PR is now based directly on main and contains only the Express 5/backend migration on top of that merged refresh.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.