chore(deps): bump vitest to 4.1.6 [security] (#1633)

## Summary

- Bump `vitest`, `@vitest/browser`, `@vitest/browser-playwright`, and
all `@vitest/*` peer/dev deps in `packages/test` from `4.1.5` to `4.1.6`
to address
[GHSA-2h32-95rg-cppp](GHSA-2h32-95rg-cppp).
- Updates catalog entries in `pnpm-workspace.yaml` (`vitest`,
`@vitest/browser*`) and the `vitest-dev` override.
- Refreshes `pnpm-lock.yaml` accordingly.

## Test plan

- [ ] CI passes

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Low risk dependency-only update; main impact is potential test
runner/coverage behavior changes due to the Vitest patch upgrade.
> 
> **Overview**
> Updates the test toolchain by bumping `vitest` and the `@vitest/*`
ecosystem (browser providers, runner/expect/snapshot/spy/utils, UI, and
coverage peers) from `4.1.5` to `4.1.6` in `packages/test`.
> 
> Aligns workspace catalog/overrides (`pnpm-workspace.yaml`,
`vitest-dev`) and regenerates `pnpm-lock.yaml` to lock the new versions,
primarily to address the referenced security advisory.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
428629a. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Author: fengmk2

packages/test/package.json

@@ -293,17 +293,17 @@
     "@blazediff/core": "1.9.1",
     "@oxc-node/cli": "catalog:",
     "@oxc-node/core": "catalog:",
-    "@vitest/browser": "4.1.5",
-    "@vitest/browser-playwright": "4.1.5",
-    "@vitest/browser-preview": "4.1.5",
-    "@vitest/browser-webdriverio": "4.1.5",
-    "@vitest/expect": "4.1.5",
-    "@vitest/mocker": "4.1.5",
-    "@vitest/pretty-format": "4.1.5",
-    "@vitest/runner": "4.1.5",
-    "@vitest/snapshot": "4.1.5",
-    "@vitest/spy": "4.1.5",
-    "@vitest/utils": "4.1.5",
+    "@vitest/browser": "4.1.6",
+    "@vitest/browser-playwright": "4.1.6",
+    "@vitest/browser-preview": "4.1.6",
+    "@vitest/browser-webdriverio": "4.1.6",
+    "@vitest/expect": "4.1.6",
+    "@vitest/mocker": "4.1.6",
+    "@vitest/pretty-format": "4.1.6",
+    "@vitest/runner": "4.1.6",
+    "@vitest/snapshot": "4.1.6",
+    "@vitest/spy": "4.1.6",
+    "@vitest/utils": "4.1.6",
     "chai": "^6.2.1",
     "convert-source-map": "^2.0.0",
     "estree-walker": "^3.0.3",
@@ -316,16 +316,16 @@
     "rolldown": "workspace:*",
     "rolldown-plugin-dts": "catalog:",
     "tinyrainbow": "^3.1.0",
-    "vitest-dev": "^4.1.5",
+    "vitest-dev": "^4.1.6",
     "why-is-node-running": "^2.3.0"
   },
   "peerDependencies": {
     "@edge-runtime/vm": "*",
     "@opentelemetry/api": "^1.9.0",
     "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0",
-    "@vitest/coverage-istanbul": "4.1.5",
-    "@vitest/coverage-v8": "4.1.5",
-    "@vitest/ui": "4.1.5",
+    "@vitest/coverage-istanbul": "4.1.6",
+    "@vitest/coverage-v8": "4.1.6",
+    "@vitest/ui": "4.1.6",
     "happy-dom": "*",
     "jsdom": "*",
     "vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
@@ -363,6 +363,6 @@
     "node": "^20.0.0 || ^22.0.0 || >=24.0.0"
   },
   "bundledVersions": {
-    "vitest": "4.1.5"
+    "vitest": "4.1.6"
   }
 }