Update the exact Viewer.js dependency pin and lockfile, pristine JavaScript and CSS, MIT license, and provenance hashes together.

Validation completed before this PR was opened:
- Vendored assets match the installed locked package.
- Vendoring tooling and existing frontend tests pass.
- Chromium desktop and touch compatibility checks pass for the gallery, admin, and tag viewers.

Review the [upstream releases](https://github.com/fengyuanchen/viewerjs/releases) for behavioral changes. This PR requires review and is not automatically merged.