chore(deps-dev): bump vitest 3.2.4 → 4.1.7 + @vitest/coverage-v8

Re-applied after main moved (zustand 5 + size-limit 12 + 5 GH actions
landed since the original dependabot commit, causing a package-lock
conflict that dependabot couldn't auto-resolve).

@vitest/coverage-v8 must match vitest's major (3.x ↔ 4.x have strict
peer enforcement); without the pair-bump npm ci hard-fails ERESOLVE.

No vitest.config migration needed: this repo uses inline test config
in vite.config.ts (globals/jsdom/setupFiles/include/exclude/passWithNoTests),
none of which were removed in v4.

Local gate green: 74 files / 1039 passed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: claude