chore: bump dependencies (ajv, ajv-formats, vitest, ref-parser, path-to-regexp) (#2)

Bumps everything except TypeScript. Notably crosses the ajv-formats
v2 → v3 major (no impact: project does not use date-time format
strings, which is the only behavioral break in v3). Also closes the
fast-uri high-severity advisory transitively pulled in by ajv <8.20.

- ajv ^8.18.0 → ^8.20.0
- ajv-formats ^2.1.1 → ^3.0.1
- @apidevtools/json-schema-ref-parser ^15.3.4 → ^15.3.5
- path-to-regexp ^8.4.0 → ^8.4.2
- vitest ^4.1.2 → ^4.1.5
- @vitest/coverage-v8 ^4.1.2 → ^4.1.5

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: kevinccbsg