chore(homepage): address vulnerable CDN-loaded libraries

Context

Lighthouse's js-libraries audit checks loaded JavaScript against the Snyk vulnerability database. The homepage loads three libraries via CDN in src/pages/_document.jsx:

Library	Version	CDN
jQuery	3.5.1	cdn.jsdelivr.net
Bootstrap	4.6.2	cdn.jsdelivr.net
FontAwesome	5.15.4	cdn.jsdelivr.net

If the js-libraries audit is currently failing (confirm with a Lighthouse run), these outdated library versions are the cause.

---

Investigation step

Run Lighthouse against production and check whether js-libraries is listed as a failing audit:

npx lighthouse https://openstartervillage.netlify.app \
  --output=json --output-path=lighthouse-prod.json \
  --only-categories=best-practices --chrome-flags="--headless --no-sandbox"

node -e "
  const r = require('./lighthouse-prod.json');
  const a = r.audits['js-libraries'];
  console.log(a.score, JSON.stringify(a.details, null, 2));
"

---

Fix options

Option A — Minimal: update CDN versions

Update src/pages/_document.jsx to use more recent versions:

• jQuery: 3.5.1 → 3.7.1
• Bootstrap: 4.6.2 → 5.3.x (Bootstrap 5 drops the jQuery dependency)
• FontAwesome: 5.15.4 → 6.x

Note: Bootstrap 5 removes jQuery as a dependency and has breaking API changes. Audit all Bootstrap 4 component usage before upgrading.

Option B — Preferred: remove CDN scripts entirely

Bootstrap and FontAwesome are loaded globally but may only be used in a handful of components. Audit actual usage and either:

• Import as npm packages (tree-shaken, no CDN round-trip)
• Or remove entirely if usage is minimal

This is a larger change and should land in its own PR.

---

Acceptance criteria

• Lighthouse js-libraries audit passes (no vulnerable libraries detected)
• No visual regressions on homepage, cards, and resource pages
• yarn lint passes