fix: remediate Worker dependency alerts

[leocuisine]

Summary

• Replace the misspelled root wangler dependency with patched Wrangler 4.131.1 and regenerate the Worker lockfile.
• Migrate the nested API tests to Cloudflare's current @cloudflare/vitest-plugin 1.1.8 integration.
• Update Vitest to 4.1.11, Wrangler to 4.131.1, and regenerate the nested lockfile.
• Restrict CodeQL to JavaScript/TypeScript, remove the obsolete Ruby job, and update checkout/CodeQL actions to Node 24-compatible/current major versions.
• Re-enable the inactive CodeQL workflow so the next main push can reconcile stale findings from the deleted Jekyll asset.

Verification

• npm audit --omit=optional in worker/ — 0 vulnerabilities.
• npm audit --omit=optional in worker/pswiki-api/ — 0 vulnerabilities.
• npm ci --ignore-scripts --no-audit --no-fund --legacy-peer-deps — passed.
• npm test -- --run — 1 file, 4 tests passed.
• npx tsc --noEmit — passed.
• Prettier check and git diff --check — passed.

Notes

The eight existing CodeQL alerts all target assets/js/distillpub/template.v2.js, which was deleted during the MkDocs migration. The CodeQL workflow is active again, but those alerts will be reconciled only after a fresh analysis runs on main.

Closes the dependency remediation identified in the Dependabot audit. No alerts were manually dismissed.