build(deps): take the SDK 57.0.18 pins, which lifts Metro clear of the image-size advisory

react-native moves 0.86.0 to 0.86.3 and with it Metro 0.84.4 to 0.84.5, which
drops the image-size dependency entirely. That clears all four high advisories
at once: image-size has no patched release at any version, so the only way out
of it was the dependency going away.

jest-expo has to move in the same commit. expo install --fix rewrites
dependencies and never devDependencies, and react-native 0.86.3 pins
@react-native/jest-preset to exactly 0.86.3 while jest-expo 57.0.2 peers
^0.86.0 against the old preset still in the tree, so the install ERESOLVEs
until both move together. 57.0.5 is the value bundledNativeModules.json
carries.

Also takes reanimated 4.5.1, worklets 0.10.1, the @roxyapi/sdk, lucide,
nativewind and lefthook bumps in range, and normalizes the expo range to the
tilde that expo install --fix writes.

Held: react-native 0.87, async-storage 3, gesture-handler 3 and the rest of
the native set are Expo-owned pins, not upgrades. jest 30, tailwind 4 and
typescript 7 stay per the documented holds. Expo SDK 58 has no stable release,
only canary builds.

npm audit: 18 (4 high, 14 moderate) to 14 (0 high, 14 moderate). The residue is
two roots and neither is actionable. uuid reaches only through
xcode and @expo/config-plugins, a build-time path that never enters the bundle.
decode-uri-component is patched only on 0.5.0, which is ESM only and exports an
object, while its consumer query-string 7.1.3 requires it and calls it as a
function, so the override would throw on every encoded query parameter and no
test would see it.

Gate green: expo install --fix reports up to date, expo-doctor 21/21, tsc,
tests, expo export for android, npm ci from the regenerated lock.

Author: ph33nx