chore(devdeps): pin vite-plus to 0.1.13 to fix broken native binding

[sherwinski]

Description

1 Line Summary

Pin vite-plus to 0.1.13 to fix a broken native binding in 0.1.14 that prevents tests from running.

Details

vite-plus@0.1.14 ships JS code in @voidzero-dev/vite-plus-core that calls getOrder() on the Rolldown native binding (BindingCallableBuiltinPlugin), but the companion native binary (@voidzero-dev/vite-plus-darwin-arm64@0.1.14) doesn't expose that method, causing a TypeError: callablePlugin.getOrder is not a function startup crash before any tests run.

Changes:

• Pin vite-plus and its pnpm overrides from latest to 0.1.13 (last working version)
• Add explicit vite and vitest devDependencies aliased to the vite-plus packages so third-party plugins (vite-plugin-mkcert, @vitest/coverage-v8) can resolve their peer dependencies — the pnpm overrides alone don't install them since nothing declares vite/vitest as a regular dependency
• Add missing beforeEach/afterEach imports in detect.test.ts

Systems Affected

• WebSDK
• Backend
• Dashboard

Validation

Tests

Info

Checklist

• All the automated tests pass or I explained why that is not possible
• I have personally tested this on my machine or explained why that is not possible
• I have included test coverage for these changes or explained why they are not needed

Programming Checklist
Interfaces:

• Don't use default export
• New interfaces are in model files

Functions:

• Don't use default export
• All function signatures have return types
• Helpers should not access any data but rather be given the data to operate on.

Typescript:

• No Typescript warnings
• Avoid silencing null/undefined warnings with the exclamation point

Other:

• Iteration: refrain from using elem of array syntax. Prefer forEach or use map
• Avoid using global OneSignal accessor for context if possible. Instead, we can pass it to function/constructor so that we don't call OneSignal.context

Screenshots

Info

N/A — dependency and import-only changes, no UI impact.

Checklist

• I have included screenshots/recordings of the intended results or explained why they are not needed

---

Related Tickets

---

[claude]

LGTM — straightforward dev-dependency pin to restore test runner functionality.

Extended reasoning...

Overview

This PR touches package.json, pnpm-lock.yaml, and one test file (detect.test.ts). The changes pin vite-plus and its associated pnpm overrides from latest to 0.1.13, add explicit vite/vitest devDependency aliases so third-party plugins can resolve peer deps, and add missing beforeEach/afterEach imports in the test file.

Security Risks

No security-sensitive code is touched. All changes are confined to dev dependencies and the test toolchain — nothing here reaches production bundles. The incidental transitive bumps in the lockfile (axios, graphql, undici, proxy-from-env) are all dev/test-only packages.

Level of Scrutiny

Low. This is a targeted hotfix to unblock the test suite after an upstream package shipped a broken native binding. The root cause is clearly documented, the fix is minimal and reversible (pinning to a known-good version), and no application logic is changed.

Other Factors

The detect.test.ts change is a trivially correct import fix — beforeEach/afterEach were used but not imported. No logic changes. The lockfile regeneration is consistent with the package.json changes. No outstanding reviewer comments.