fix: resolve security findings and update dependencies

- Fix CodeQL alerts (CWE-312): replace clear-text logging of oauthConfig
  server URLs with safe hostname-only identifiers via safeServerLabel()
  helper in refreshOAuthToken() (alerts #18, #19, #20)
- Upgrade vite 8.0.1 → 8.0.7 (fixes GHSA-4w7w-66w2-5vf9,
  GHSA-v2wj-q39q-566r, GHSA-p9ff-h696-f583: path traversal and
  arbitrary file read in dev server)
- Upgrade @github/copilot-sdk 0.2.0 → 0.2.1
- Upgrade @sveltejs/kit 2.55.0 → 2.56.1
- Upgrade svelte 5.54.1 → 5.55.2
- Upgrade marked 17.0.4 → 17.0.6 (race condition fix)
- Upgrade @playwright/test 1.58.2 → 1.59.1
- Upgrade @types/node 25.5.0 → 25.5.2
- Upgrade @vitest/coverage-v8 4.1.0 → 4.1.3
- Upgrade vitest 4.1.0 → 4.1.3
- Upgrade svelte-check 4.4.5 → 4.4.6
- Upgrade actions/upload-artifact v4 → v7 in CI workflow

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: devartifex

.github/workflows/ci.yml

@@ -71,7 +71,7 @@ jobs:
 
       - name: Upload Playwright report
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: playwright-report
           path: playwright-report/