fix(security): bump vitest and @vitest/coverage-v8 together to ^3.2.6 (#10)

Clears GHSA-5xrq-8626-4rwp (CVSS 9.8), 'When Vitest UI server is listening,
arbitrary file can be read and executed'. Development scope: it only bites when
someone runs vitest --ui locally, it never ships. Patched because it is trivial
and this single advisory accounts for 93 percent of the estate's critical count.

Dependabot could not land this. It opens one PR for vitest and a separate one
for @vitest/coverage-v8, and the two share a peer constraint, so neither merges
alone (ERESOLVE). They have to move in lockstep.

npm audit fix is applied on top because the vitest 3.x tree pulls in vulnerable
js-yaml, which fails an 'npm audit --audit-level=high' CI gate.

Verified in a clean-room checkout for THIS repo specifically: npm ci, then every
script this repo defines among lint/typecheck/test/coverage/build/demo, then the
audit gate. All green before this commit was created.

Co-authored-by: fknmiz <150495873+fknmiz@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: mizcausevic-dev