security: upgrade Expo SDK 52 through supported releases

Context

A fresh npm audit --omit=dev in apps/mobile on 2026-07-10 reports 12 high and 5 moderate advisories. The findings are transitive through the Expo SDK 52 CLI/config/build dependency graph; npm's available fix moves the project to Expo 57 and is therefore a semver-major migration.

This issue does not claim that every advisory is reachable in the shipped learner runtime. The first deliverable is to separate build-time/tooling exposure from runtime exposure, then remove or document each residual finding.

Expo recommends upgrading SDK versions incrementally, one at a time: https://docs.expo.dev/workflow/upgrading-expo-sdk-walkthrough/

Scope

Move the mobile app from Expo SDK 52 toward a currently supported SDK without mixing in unrelated UI or learning-content changes. The migration will need to account for expo-av deprecation/removal and the React / React Native version changes across SDK releases.

A contributor may propose this as multiple sequential PRs, but each PR must represent one complete, reviewable SDK step and link back to this issue. Do not split cosmetic lockfile churn into separate PRs.

Acceptance criteria

• Record the pre-upgrade audit summary and classify findings as build-time, development-time, or learner-runtime reachable.
• Upgrade Expo one SDK version at a time, following each official changelog.
• Run npx expo install --fix and npx expo-doctor at every SDK boundary.
• Migrate removed APIs such as expo-av before the SDK version that removes them.
• Keep mock mode and the hosted web-demo flow working.
• npm run verify passes in apps/mobile.
• A production web export succeeds using the documented demo build path.
• npm audit --omit=dev has no high-severity finding, or each unavoidable residual finding has a linked upstream advisory, reachability analysis, and explicit follow-up issue.
• Update mobile setup and release notes with the final Node, Expo, React, and React Native versions.

Guardrails

• Do not add generated audio, screenshots, local engines, secrets, or private test data.
• Do not use npm audit fix --force without reviewing the exact Expo and React Native migration.
• Do not label this as first-timers-only; it is suitable for an experienced Expo/React Native contributor.
• Ask questions here before starting a broad migration PR.

Verification

cd apps/mobile
npm ci
npm run verify
npm audit --omit=dev

For each SDK boundary, include the expo-doctor output summary and the official Expo changelog used.