Fix remaining npm dependency security advisories #2

The October security audit found npm dependencies still needing remediation, separately from the Rust backports in #1. GitHub currently reports 13 open npm alerts; a fresh pnpm audit reports 16 advisory entries (2 critical, 5 high, 8 moderate, 1 low).

Affected packages include Vite/launch-editor, Vitest/@vitest/mocker, tinypool, postcss, nanoid, browserslist, baseline-browser-mapping and source-map-js. These include build/test/development tooling; advisory presence alone does not establish an exposed production endpoint.

Update affected direct dependency floors and resolve patched transitive versions. The Vitest 3 line has no listed fix for the current mocker advisories, requiring a qualified move to patched Vitest 4 (at least 4.1.12). Preserve application and test behavior, use supported dependency ranges, and do not suppress advisories or remove tests. Verify the full workspace tests, TypeScript/Vite builds, a frozen lockfile install and a fresh unfiltered audit. Record any remaining findings explicitly.

Sources: the repository's Dependabot alerts and npm audit; GHSA-82fw-gwwq-j7x9 ; https://v4.vitest.dev/guide/migration.html .