chore(deps-dev): bump vitest to 5 with regenerated bun.lock (fixes #982 CI)

[trac3r00]

Fixes the CI failure on #982 (Dependabot: vitest 4.1.11 -> 5.0.1). Supersedes #982 if merged; #982 itself can then be closed.

What changed

• package.json: Dependabot's commit from chore(deps-dev): bump vitest from 4.1.11 to 5.0.1 #982 cherry-picked unchanged (vitest ^4.1.2 -> ^5.0.1).
• bun.lock: regenerated so bun install --frozen-lockfile passes. chore(deps-dev): bump vitest from 4.1.11 to 5.0.1 #982 changed only package.json, so every CI job died at Install dependencies (error: lockfile had changes, but lockfile is frozen). The lockfile diff (+31/-35) is limited to vitest and its transitive deps: vitest 5.0.2, @vitest/mocker + @vitest/spy 5.0.2, @vitest/expect/runner/snapshot/utils/pretty-format removed (inlined upstream), magic-string 1.x, tinybench 6, why-is-node-running 3, plus nested pins keeping existing consumers (vite, sucrase, @jridgewell) on their previous versions. Resolved against registry.npmjs.org (no private-registry URLs).
• No config or test changes. Vitest 5 requires Vite >= 6.4 (lockfile has 8.0.3) and Node >= 22.12 (CI uses 22).

Vitest 5 migration checklist (https://vitest.dev/guide/migration)

• clearMocks now default true: only worker.debug-sentry.test.js asserts call counts, and it already resets the mock in beforeEach; behavior unchanged.
• Hoisted vi.mock must be top-level: both uses (worker.http-semantics, worker.debug-sentry) are top-level.
• sequential removal, toThrow(""), expect.poll, fake timers, bench, deprecated entry points, projects/extends: not used.
• .vitest/ artifacts dir: already in .gitignore.
• vitest list is now static collection, so dynamic it.each/loop tests show as template names there; test-set comparison below uses real-run JSON reporter output instead.

Evidence (local, macOS arm64, bun 1.4.0, node 22.23)

• bun install --frozen-lockfile on chore(deps-dev): bump vitest from 4.1.11 to 5.0.1 #982 head: fails (reproduced). On this branch: exit 0.
• bun run build: exit 0.
• vitest run base (main 8b1951c, vitest 4.1.2) vs this branch (vitest 5.0.2), JSON reporter: 59 files / 712 tests / 712 passed on both; 0 test names only in one side, 0 status differences.
• Fault injection: altering one toThrow expectation in src/services/qr.test.js makes vitest 5 exit 1 (reverted), so failures are still detected.
• Playwright E2E: local run 282 passed / 2 skipped (PW_PORT override, same head); CI E2E (Playwright) on this PR: both runs green.

Risk

Dev-dependency only; no runtime/Worker code changes. Main risk is a test-runner behavior change masking a regression; mitigated by identical test set and pass/fail status vs base and the fault-injection check.

Rollback

Revert this PR's merge commit (restores vitest 4 and the old lockfile).

---

Summary by cubic

Bumps vitest from ^4.1.2 to ^5.0.1 and regenerates bun.lock so bun install --frozen-lockfile passes in CI. Supersedes #982, which only changed package.json and caused every CI job to fail at the install step.

The lockfile diff is limited to vitest and its transitive deps; no config or test changes were needed.

Migration

• Ran the vitest 5 migration checklist; none of the breaking changes apply to this repo.
• Confirmed identical test results vs main (712/712 passing, no name or status differences); fault injection verified failures are still detected.

^{Written for commit deb1b0a. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 2 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Shadow auto-approve: would auto-approve. Bumps vitest 4.x to 5.0.1 and regenerates bun.lock so frozen-lockfile CI passes; dev-dependency only with no source/config changes, migration checklist verified, and identical test results plus fault-injection checks confirm correctness.

Re-trigger cubic</sub>