chore(deps): migrate apps/web to Vite 8 (#48)

[vianbas]

Summary

Upgrades apps/web from Vite 6.4 to Vite 8.3 together with @vitejs/plugin-react 4.7 → 6.1. The two have to move in one change: @vitejs/plugin-react 4 only accepts Vite 4–7, which is why Dependabot's single-package bumps (#21, #32) fail npm ci with ERESOLVE.

Closes #48

Supersedes #32.

Why now:

• Support. Vite 6.4 is on security-only support. Only 8.3 gets regular patches; 7.3 and 8.2 get important fixes (https://vite.dev/releases). 6.x has had no release since 6.4.3 on 2026-06-01.
• Unblocks Dependabot. Vite bumps can't merge on their own until this lands.
• Faster builds. The production build dropped from 1.09 s to 0.70 s locally.

Architecture summary

• Only apps/web/package.json and package-lock.json change. vite.config.ts, postcss.config.js and the Tailwind 3 setup are unchanged. The config uses none of the options Vite 8 renamed or removed (build.rollupOptions, esbuild, manualChunks), and react() is called without options.
• Behaviour that changes under Vite 8:
  • Rolldown replaces Rollup/esbuild for bundling and dependency pre-bundling.
  • Oxc does the JS/JSX transform and React Fast Refresh; plugin-react 6 no longer ships Babel.
  • Lightning CSS minifies CSS.
  • The default browser target rises to Chrome/Edge 111, Firefox 114 and Safari 16.4.
• Vitest stays on 4.1.9, which already accepts vite ^6 || ^7 || ^8.
• Node 20.19+ or 22.12+ is required. CI and the web Dockerfile already use Node 24.

Security considerations

• Only dev dependencies change. The runtime bundle is still React plus the existing app dependencies. No secrets, data or proxy settings are touched.
• None of the open Dependabot alerts are for Vite itself. The remaining ones (postcss, react-router, browserslist, brace-expansion, vitest/@vitest/mocker) are handled by their own open PRs and are out of scope here.
• npm ls --all shows only unmet optional dependencies (per-OS native bindings and optional peers): 52 lines, down from 73 on main.

Testing evidence

$ make verify
ok  	github.com/vianbas/finwatch/apps/api/...   (all 13 Go packages ok; backend unchanged by this PR)
 Test Files  6 passed (6)
      Tests  17 passed (17)
dist/assets/index-C9FYIbTn.css    8.50 kB │ gzip:  2.68 kB
dist/assets/index-q97Bwyjk.js   292.07 kB │ gzip: 92.60 kB
✓ built in 267ms

• A fresh npm ci succeeds. This is the step that failed for chore(deps): bump vite from 6.4.3 to 8.0.16 in /apps/web #21 and chore(deps): bump vite from 6.4.3 to 8.1.0 in /apps/web #32.
• lint, tsc --noEmit, vitest (17/17, no warnings) and vite build all pass.

Bundle, Vite 6.4.3 → Vite 8.3.0:

	Vite 6.4.3	Vite 8.3.0
JS	301.81 kB (95.28 kB gzip)	292.07 kB (92.60 kB gzip)
CSS	9.71 kB	8.50 kB
Build time (one cold local run each)	1.09 s	0.70 s

CSS before/after, compared on both builds: the same 95 class selectors, 53 --tw-* properties, 18 theme variables and 2 @media blocks. The only prefixed declaration that disappears is -moz-tab-size, which Firefox 114+ doesn't need.

In the browser:

• The production build (vite preview) and the nginx container image both redirect /dashboard → /login and render the same styles as before (button, heading, inputs checked with computed styles).
• On the dev server, the /@react-refresh preamble is injected and modules register with $RefreshReg$.

Known limitations

• The higher default browser baseline drops Safari < 16.4, Chrome/Edge < 111 and Firefox < 114.
• vite dev / vite preview log a 404 for /favicon.ico because index.html declares no favicon. This predates the upgrade; nginx answers it with index.html.

Follow-up issues

• Close chore(deps): bump vite from 6.4.3 to 8.1.0 in /apps/web #32 once this merges, since this PR supersedes it.
• Security bumps still open: chore(deps): bump postcss from 8.5.15 to 8.5.25 in /apps/web #40 (postcss), chore(deps): bump react-router and react-router-dom in /apps/web #41 (react-router), chore(deps): bump browserslist from 4.28.2 to 4.28.9 in /apps/web #44 (browserslist), chore(deps): bump brace-expansion from 5.0.6 to 5.0.7 in /apps/web #39 (brace-expansion), chore(deps): bump @vitest/mocker and vitest in /apps/web #45 (vitest / @vitest/mocker).

Checklist

• Branch is not main; this PR targets main.
• Conventional commit messages.
• make verify passes locally.
• git diff --check is clean.
• No secrets, real/personal data, or proprietary references.
• Contracts updated first where applicable (OpenAPI/AsyncAPI) — n/a, no contract change.
• Docs updated to match the change — none mention the Vite or Node version.