Resolve dependency advisories while retaining Node 20 support

[TechLuddite]

The lockfile contained the vulnerable versions reported by S5 and npm audit. Upgrade Vitest and refresh compatible transitive patches to remove every reported advisory while retaining the declared Node >=20 support.

• Vitest and @vitest/mocker: 3.2.7 → 4.1.11; vulnerable tinypool 1.1.1 removed.
• brace-expansion: 1.1.18 → 1.1.21 and 5.0.9 → 5.0.12.
• js-yaml: 4.3.1 → 4.3.2; nanoid: 3.3.16 → 3.3.20; source-map-js: 1.2.1 → 1.2.2.

Checked GitHub advisory ranges for the scanner's IDs: the selected versions are outside the affected ranges. This changes package.json and package-lock.json only; other direct dependency versions and the Node engine are retained.

Validation under Node 20.20.2:

• Clean npm ci, typecheck, lint, all unit tests and production build pass.
• npm audit --json: zero vulnerabilities.
• A separate combined checkout with Remove simulated routes and add dashboard quick launches #20 passes all 356 unit tests, the production build, and Chromium browser regressions, including authorization, quick launches, missing measurement fields and offline speed results.
• Existing lint and bundle-size warnings remain.

Closes #17. Independent of #20; combined validation confirms compatibility.