Clarify bundled third-party dependencies

[BorisTyshkevich]

What changed

• Replace the misleading “zero third-party requests” marketing claim with precise language: runtime dependencies are bundled and no third-party CDN assets are loaded.
• Correct the documented runtime dependency count to seven and include date-fns.
• Add the missing license notices for chartjs-adapter-date-fns, date-fns, and marked.

Why

The application has third-party runtime dependencies and contacts the configured OAuth IdP. The previous wording conflated bundled dependencies with network requests and omitted several packages from the notices.

Verification

• npm test — 167 files / 5,074 tests; 100% statements and lines
• npm run build
• Verified the new notices are embedded in dist/sql.html
• git diff --check