deps(dashboard): vitest 4, closing the one critical alert in the queue

[blitzcrieg1]

Replaces #68.

Dependabot proposed this and could not land it. Its lockfile went stale against master twice while other merges moved underneath it, and both CI runs failed at npm ci with a sync error rather than on anything to do with vitest:

npm error `npm ci` can only install packages when your package.json and
package-lock.json are in sync.
npm error Missing: esbuild@0.28.2 from lock file

A third rebase would have raced the same way, so this does the upgrade directly.

It is the only critical in the queue

The advisory needs 3.2.6 or later; this goes to 4.1.11.

Worth stating plainly: it was never reachable here. The CVE requires the Vitest UI server to be listening, which it is not during vitest run in CI or locally. Closing it is hygiene, not incident response.

Verified

• 99 tests pass, unchanged. No test file needed editing
• tsc --noEmit clean
• lint clean
• static export builds both routes

One warning it surfaces

@vitejs/plugin-react now warns its esbuild options are deprecated in favour of oxc. That is the plugin's problem, it is a warning rather than a failure, and Dependabot has a plugin bump open that can carry the fix.

🤖 Generated with Claude Code

[blitzcrieg1]

Closing in favour of #90, which is strictly better.

Mine did vitest 2.1.9 to 4.1.11. #90 does that plus @vitejs/plugin-react 4.7.0 to 6.1.0, which fixes the deprecation warning my own PR description flagged as "the plugin's problem" and left for a future bump. It also widens the vite constraint to ^8.

Same critical alert closed, one fewer warning, one fewer PR.