build(deps-dev): upgrade web/ to Vite 8 + Vitest 4 (coordinated cluster bump)

[SyniRon]

Closes #59 (retargeted from Vite 7 to Vite 8 — 8.x went stable after the issue was written, and @vitejs/plugin-react@6 requires it; stopping at 7 would have recreated the same Dependabot deadlock one major later).

Coordinated bump of the version-locked Vite cluster in web/:

Package	Before	After
vite	^5.4.10	^8.0.16
vitest	^2.1.9	^4.1.8
@vitejs/plugin-react	^4.3.3	^6.0.2
@types/node	— (transitive)	^25 (explicit)

Lockfile regenerated and deduped — single major of everything, no vite 5/7 or @types/node 24 remnants. jsdom unchanged at 29.x.

Changes beyond version bumps:

• @types/node added as a direct devDependency + "node" in tsconfig types — Vitest 4 no longer supplies Node types transitively, which broke tsc on test files importing node:fs/node:path. (^25 rather than ^24 to dedupe with the transitive resolution; @types/node@26 doesn't exist yet.)
• localStorage test polyfill retained with updated rationale (web/src/test-setup.ts) — removal was attempted (suite passes without it on Node 24.16 / vitest 4.1.8) but CI on Node 26 proved the populateGlobal bug still reproduces there; comment now records the node-version dependence.
• e2e hardening: tests now fail on uncaught page errors (catches "renders but throws" bundler regressions), and e2e/playwright.config.ts gains an optional E2E_CHROMIUM_PATH env override for hosts where Playwright's bundled Chromium isn't installable — supplied at runtime, no host-specific path committed; CI behavior unchanged.
• PROJECT.md test-count drift fixed (counts dropped — they always rot).
• vite.config.ts / vitest.config.ts: no changes needed.

Notes:

• Vite 8 = Rolldown bundler. Local build dropped 1.7s → 0.2s; output bundle marginally smaller.
• Implicit browser-floor raise: no build.target is set, so the default moves from Vite 5's 'modules' (~Chrome 87/Safari 14) to baseline-widely-available (~Chrome 107+/Safari 16+). Accepted deliberately.
• @sentry/vite-plugin (5.3.0, latest) loads and builds cleanly under Rolldown, but the sourcemap upload/delete path only exercises on tagged release builds with auth — watch the first tagged release (maps emitted, upload succeeds, maps deleted before the Caddy stage). Follow-up idea: CI assertion that the image serves no *.map.

Verification (local, full gate):

• vite build ✓ (tsc + rolldown)
• vitest run ✓ 208/208 (14 files; same count as pre-bump baseline)
• Playwright smoke ✓ 6/6 (incl. new pageerror guard)
• Docker image build (node:26-alpine, frozen lockfile) ✓

Reviewed pre-merge by code-reviewer, comment-analyzer, and pr-test-analyzer agents; all critical/important findings addressed. Supersedes Dependabot's stale @vitejs/plugin-react attempts (e.g. #4).

🤖 Generated with Claude Code