chore(deps): bump nine npm packages in one branch

[htcom-code]

Dependabot opened two PRs against the same base commit (e6fa9a3): #60 (production, 3 packages) and #61 (development, 6 packages). Merging them one at a time would make the other wait for a rebase and burn a second CI round, so this consolidates both into a single green tree.

What changed

Production (from #60)

package	from	to
@tanstack/react-virtual	3.14.11	3.14.13
lucide-react	1.43.0	1.46.0
tailwind-merge	3.6.0	3.7.0

Development (from #61)

package	from	to
vite	8.2.2	8.3.0
oxlint	1.82.0	1.83.0
@types/node	26.5.1	26.6.1
@testing-library/dom	10.4.1	10.4.2
@vitest/coverage-v8	5.0.0	5.0.1

Plus @jridgewell/sourcemap-codec 1.5.5 -> 1.6.0 as a transitive update. No majors — every bump stays inside its existing semver range.

Lock integrity

Regenerating the lock floated lucide-react to 1.47.0 inside ^1.46.0. It is pinned back to the 1.46.0 Dependabot verified, so the tree that merges is the tree CI checked.

All 531 lock entries were then compared against the main, #60 and #61 locks: every version difference is attributable to #60 or #61, with zero unexplained drift.

Verification on the merged tree

• npm run lint — clean (the 7 only-export-components warnings are pre-existing on main)
• npm run build — ok
• npm test — 15 files / 152 tests pass
• npx vitest run --coverage — 15 files pass (Statements 79.3%, Lines 81.3%). Run separately because npm test never loads @vitest/coverage-v8, so CI alone would not exercise that bump.
• Bundle: 516.18 -> 517.35 kB (gzip 163.20 -> 163.50), +1.17 kB

Not caused by this PR

npm audit reports 3 advisories (moderate hono, high js-yaml, moderate qs). The identical 3 are present on main at e6fa9a3, and they reach the tree through shadcn -> @modelcontextprotocol/sdk -> hono/qs — dev-only, never in the shipped bundle. Tracked separately.

Closes #60
Closes #61