chore(deps): Consolidate security bumps and move the build to Vite 8

[Kyonax]

Changes:

• [MOD] package.json: Raise vite to ^8.1.0 and @vitejs/plugin-vue to ^6.0.7, the majors that carry the current build-chain advisory fixes
• [MOD] package-lock.json: Resolve vite 6.4.2 to 8.2.2, @vitejs/plugin-vue 5.2.4 to 6.0.8, js-cookie 3.0.5 to 3.0.8, ws 8.20.0 to 8.21.3, immutable 5.1.5 to 5.1.9, postcss 8.5.9 to 8.5.26, nanoid 3.3.11 to 3.3.18, js-yaml 4.1.1 to 4.3.2 and brace-expansion 1.1.14/2.1.0 to 1.1.18/2.1.4; esbuild leaves the tree because Vite 8 bundles with Rolldown

Supersedes the eight open Dependabot pull requests: #7, #8, #9, #11, #12, #13, #14, #15.

Gates: lint 0, tests 17/17, build ok, npm audit 0 vulnerabilities

[github-actions]

Protected Files Modified

One or more files in the protected set were changed in this PR. Each category below explains why the file matters.

Supply Chain

• package.json was modified
• package-lock.json was modified

Dependency or lockfile changes. Verify the diff (no unexpected packages, no version downgrades).

[Kyonax]

Closing as already delivered.

Merging #6 brought the vite 8 bump and every advisory fix onto master directly, so there is nothing left in this PR to land. Verified on the current master:

• npm audit — 0 vulnerabilities
• lockfile healthy — 516 packages, all 516 carrying resolved and integrity

This branch was cut from the pre-v0.5 package.json, which is why it now reads as conflicting. Rebuilding it against the new master produces a lockfile with no meaningful version change and 389 fewer integrity hashes, which would weaken install verification for no security gain. Not worth merging.