meteor3: React 16 -> 18.3 with createRoot

react/react-dom ^18.3.1 (--legacy-peer-deps for the pinned ancient react-*
libs, which still work on 18 via legacy context but gate React 19). Client
entry uses createRoot. Browser-verified on / and /fires; REST smoke
byte-identical (12/12).

UPGRADE.md

@@ -276,6 +276,16 @@ MONGO_CONTAINER=tcef-mongo7 MONGO_SHELL=mongosh MONGO_PORT=27019 ./smoke/smoke.s
     pinned at v18; prod data arrives pre-migrated) — tracked as debt.
   Verified in a real browser: `/` and `/fires` render (map, search, layers,
   cookie banner), zero uncaught exceptions; REST smoke byte-identical.
+- ✅ **React 16 → 18.3** — `react`/`react-dom` bumped to `^18.3.1`
+  (`--legacy-peer-deps`: the ancient react-* libs below declare 15/16 peers),
+  client entry migrated to `createRoot` (`imports/startup/client/index.js`).
+  The legacy UI libs (react-bootstrap 0.31, reactstrap 5-alpha, react-leaflet
+  1.8, react-router-dom 4, react-i18next 7) stay pinned and WORK on 18, but
+  spam the console with legacy-context/defaultProps deprecation warnings and
+  will die on React 19. **Debt**: own front-end refresh project.
+  ⚠️ npm gotcha: running `meteor npm install/uninstall` while the dev server
+  watches node_modules can crash the meteor-tool watcher mid-prune (ENOENT on
+  a watched file). Stop the server (or restart it after) when touching deps.
 
 ### Still TODO before the web (not just REST) is fully deployable on 3.x
 - **React 16 → 18** render root + verify ancient react-* libs.