Fix vulnerable dependencies by upgrading vitest and vite

[threeal]

Summary

• Upgraded vitest and @vitest/coverage-v8 from 4.0.15 to 4.1.6
• Added vite@^6.4.2 as an explicit dev dependency to force the patched version (vitest 4.1.6 still resolves to the vulnerable vite@6.3.5 without this)

Resolves 8 vulnerabilities detected by pnpm audit:

• 2 high: picomatch ReDoS (GHSA-c2c7-rcm5-vvqj), vite arbitrary file read via WebSocket (GHSA-p9ff-h696-f583)
• 4 moderate: vite path traversal, Windows fs.deny bypass, postcss XSS, picomatch method injection
• 2 low: vite middleware file serving issues

All vulnerabilities were in dev-only dependencies (not shipped). pnpm audit now reports clean.

Test plan

• pnpm audit reports no vulnerabilities
• pnpm test passes with 100% coverage
• Pre-commit hooks pass (type-check, format, lint)

🤖 Generated with Claude Code