chore(deps): bump twelve npm packages in one branch

[htcom-code]

Consolidates this week's five dependabot PRs into one branch, so the tree is
reviewed and merged once instead of five times.

Closes #54
Closes #55
Closes #56
Closes #57
Closes #58

What moves

package	from	to	reaches the bundle?
react	19.2.8	19.3.0	yes
react-dom	19.2.8	19.3.0	yes
@base-ui/react	1.7.0	1.8.0	yes
@tanstack/react-virtual	3.14.10	3.14.11	yes
lucide-react	1.39.0	1.43.0	yes
@types/react	19.2.18	19.3.0	no (types)
@types/react-dom	19.2.5	19.3.0	no (types)
@types/node	26.4.1	26.5.1	no (types)
oxlint	1.81.0	1.82.0	no (lint)
shadcn	4.20.1	4.21.0	no (CLI)
vitest	4.1.11	5.0.0	no (test)
@vitest/coverage-v8	4.1.11	5.0.0	no (test)

Two of these could not merge separately at all

#57 (vitest) and #58 (@vitest/coverage-v8) are two halves of the same major.
@vitest/coverage-v8 pins its peer to an exact vitest version, so each half
breaks the other's install. Both PRs failed lint before running a single
check, on npm ci:

While resolving: @vitest/coverage-v8@4.1.11
Found: vitest@5.0.0
Could not resolve dependency:
peer vitest@"4.1.11" from @vitest/coverage-v8@4.1.11

Neither could go in alone, and merging one would have left the other red until
a dependabot rebase. Together they install clean.

The versions are dependabot's

All twelve are pinned to exactly what dependabot resolved. The combined
vitest-5 tree exists in none of the five branches, so the lockfile had to be
re-resolved once; npm floated two packages past dependabot's pick while doing
it — @tanstack/react-virtual to 3.14.12 and lucide-react to 1.45.0 — and
both were pinned back.

Against main, the only lockfile change that no dependabot branch carries is
the removal of @vitest/utils and @vitest/pretty-format. The vitest 5 tree
has no consumer left for either; nothing in the lockfile depends on them.

Verification

Full local gate on the merged tree:

• npm ci — 444 packages, clean, which is the step that failed on chore(deps-dev): bump vitest from 4.1.11 to 5.0.0 #57/chore(deps-dev): bump @vitest/coverage-v8 from 4.1.11 to 5.0.0 #58.
• npm run lint — exit 0, 7 warnings, all the pre-existing
  only-export-components ones. oxlint 1.82.0 reports no new diagnostic.
• npm run build — tsc -b clean. This is what clears lucide-react: every
  icon imported across the app still resolves, so the four minors brought no
  removal or rename.
• npm test — 15 files, 152 tests, all passing on vitest 5.0.0. No test or
  config change was needed; vitest.config.ts uses nothing the major moved.
• Dev server rendered: dashboard, latency chart, module table and trace table
  all draw, every icon present. The only console error is the expected 502 from
  the backend on :8080 not running, and the console falls back to sample data
  as designed.

Bundle grew, and it is React

481.11 kB → 516.18 kB raw, 152.58 kB → 163.20 kB gzip. Bumping one package at a
time on main attributes it:

step	raw	gzip
main	481.11 kB	152.58 kB
+ lucide-react 1.43.0	483.89 kB	153.50 kB
+ react/react-dom 19.3.0	513.26 kB	162.20 kB
+ @base-ui/react 1.8.0	515.37 kB	163.00 kB
+ react-virtual, transitives	516.18 kB	163.20 kB

React 19.3.0 is ~84% of the growth. It is a single chunk already over the 500 kB
warning line; code-splitting it is its own change, not this one.

Pre-existing, unchanged by this PR

• npm audit reports 3 advisories (hono, js-yaml, qs), all reached only
  through shadcn → @modelcontextprotocol/sdk. Every one of those transitive
  versions is identical on main — this branch moves none of them, and
  npm audit --omit=dev reports 0.
• The IndexedDB eviction tests (quota-pressure, retention-limit) flake under
  vitest run --coverage on both trees — measured 2 failures in 10 runs on this
  branch and 2 in 22 on main, different tests each time. CI runs npm test
  without --coverage, where 10 consecutive runs were clean on both. This is
  timing sensitivity under instrumentation, not a vitest 5 regression.