[OP-20422] Install the CKEditor build from npm

[myabc]

Ticket

https://community.openproject.org/wp/OP-20422

What are you trying to accomplish?

Replaces the CKEditor build committed under frontend/src/vendor/ckeditor/ with the npm package @openproject/commonmark-ckeditor-build, pinned to an exact version in frontend/package.json. An editor change no longer needs build output copied into this repository, and the editor version in use is visible in the manifest.

The package is introduced by opf/commonmark-ckeditor-build#140. This PR currently pins a snapshot of that PR (0.0.0-canary-20261008132651) so the suite runs against it. The new Canary pins check fails on purpose until the pin is replaced with the released 12.0.0.

Users of Chinese (Simplified) and Portuguese (Brazil) now get a translated editor toolbar. The vendored loader asked for zh-CN.js where the file is zh-cn.js, and fell back to English.

What approach did you choose and why?

• The package ships the same prebuilt bundle, so the editor still registers window.OPClassicEditor, window.OPConstrainedEditor and window.OPEditorWatchdog. Only where the setup service loads it from changes.
• Translations are loaded through the package's loadTranslation, a static table of dynamic imports. A bundler cannot expand a templated import of a package path, and the table keeps every locale in its own lazy chunk: the production build has one chunk per locale (German is 18 kB), not one chunk with all 73.
• The package has its own type declarations, so the @ts-ignore on the editor import is gone.
• Canary pins rejects any 0.0.0- version in frontend/package.json. It lets a PR test an unreleased build of a package OpenProject publishes itself without that snapshot being merged. It only blocks merging once it is a required check for dev and release/*, which is a repository setting.
• The CKEDITOR_BUILD_DIR mount of the docker development setup is removed instead of moved. A mount inside node_modules would keep npm from replacing the package, and it is not needed: the editor repository's npm run watch copies each build over the installed package on the host, which the frontend container already sees. Anyone who set CKEDITOR_BUILD_DIR in their .env should set OPENPROJECT_CORE in the editor repository instead.

Not checked locally: the editor in a browser, and the local development loop against a running dev server. The feature specs are the behavioural test of this change.

Overlaps with #25889, which updates the vendored files this PR deletes; whichever merges second needs a rebase.

AI involvement

Merge checklist

• Pin replaced with the released 12.0.0 (Canary pins green)
• Canary pins marked as required check for dev and release/*
• Editor checked in a browser: formatting, mentions, macros, German and Chinese (Simplified) toolbar
• Tested major browsers (Chrome, Firefox, Edge, ...)