chore: Replace lodash with es-toolkit (#12281)

* chore: Replace lodash with es-toolkit

Migrate all direct lodash imports to es-toolkit/compat for a smaller,
faster, lodash-compatible utility library. Transitive lodash usage from
other packages remains unchanged.

* fix: Restore isPlainObject semantics in CanCan policy

The lodash migration aliased `isObject` to `lodash/isPlainObject` and
the codemod incorrectly mapped the local name to es-toolkit's `isObject`,
which also returns true for arrays and functions. This caused condition
objects in policy definitions to be skipped, breaking authorization
checks across the codebase.

* fix: Restore unicode-aware length counting in validators

es-toolkit/compat's size() returns string.length, while lodash's _.size()
counts unicode code points. Switch to [...value].length to preserve the
previous behavior so multi-byte characters like emoji count as one.

package.json

@@ -126,6 +126,7 @@
     "email-providers": "^1.14.0",
     "emoji-mart": "^5.6.0",
     "emoji-regex": "^10.6.0",
+    "es-toolkit": "^1.46.1",
     "es6-error": "^4.1.1",
     "fast-deep-equal": "^3.1.3",
     "fetch-retry": "^5.0.6",
@@ -163,7 +164,6 @@
     "koa-send": "5.0.1",
     "koa-sslify": "5.0.1",
     "koa-useragent": "^4.1.0",
-    "lodash": "^4.17.23",
     "mailparser": "^3.7.5",
     "mammoth": "^1.11.0",
     "markdown-it": "^14.1.1",