build(deps): bump express to v5 and migrate wildcard route

[TimothyJones]

Bumps express from ^4.20.0 / ^4.21.0 to ^5.1.0 (resolves to 5.2.1) and @types/express from ^4.17.14 to ^5.0.0 (resolves to 5.0.6) in every package that uses them:

• case-core-plugin-http (runtime dependency)
• case-core, contract-case-dsl-js-jest, contract-case-dsl-js-vitest (dev dependencies, test servers)
• case-entities, case-core-plugin-http-dsl (@types/express only)

Why #950 failed

#950 bumped the dependency without migrating the code. Express 5 uses router@2 / path-to-regexp@8, which rejects a bare '*' route pattern at registration time (TypeError: Missing parameter name), so the HTTP mock server in case-core-plugin-http crashed on startup. That PR is also a year stale and now conflicts with main (it predates the contract-case-jest → contract-case-dsl-js-jest package split).

Migration

The only code change needed was the catch-all route in mockHttpServer.ts:

- app.all('*', (req, res, next) => {
+ app.all('/{*splat}', (req, res, next) => {

'/{*splat}' is the express 5 spelling of "match every path", including /.

Everything else already used express-5-compatible APIs — the test servers use literal routes, :param path parameters, res.format, and body-parser@2 (which is already the express 5-era version), and none of the other v4→v5 breaking changes (res.redirect('back'), req.param(), magic status res.send(code), etc.) appear in the codebase.

Verification

• nx run-many -t build,lint for all six changed packages plus nine downstream dependents (case-connector, cli, contract-case-dsl-js, …): all green
• case-core tests: 27 suites / 454 tests pass, exercising the migrated mock server against the express test server via the full contract-testing flow
• case-core-plugin-http tests: pass
• The jest/vitest DSL suites couldn't run fully in the sandbox because their test servers bind to '::' and the container has no IPv6 (a bare Node net.listen(0, '::') fails identically there, so it's environmental, not express-related); those suites run in CI

Lockfile changes are limited to the express upgrade — the only new transitive dependencies are express 5's own router, path-to-regexp, and is-promise. The remaining express@4 in the lockfile is a transitive dependency of docusaurus (webpack-dev-server), which is out of scope here.

Closes #950

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ct3i5iaQ1pNwSDofkY37bv

---

Generated by Claude Code