chore(deps): clear frontend security audit (vite 8, vitest 4, plugin-react 5) (#40)

The CI Security Audit (npm audit --audit-level=high) started failing on all
new PRs after a critical advisory was published against vitest <4.1.0
(GHSA-5xrq-8626-4rwp — Vitest UI server arbitrary file read/exec). The
remediation chain also requires vite to move off the vulnerable esbuild range.

These are devDependencies (test/build tooling) and do not ship in the
production image, so there was no runtime exposure to deployed users — but the
audit gate blocks the pipeline, so bump them:

- vite        ^5.0.11 -> ^8.0.16
- vitest      ^3.0.5  -> ^4.1.8
- @vitejs/plugin-react ^4.2.1 -> ^5.2.0 (vite 8 peer compatibility)

Vite 8 ships the rolldown bundler, which requires rollupOptions.output
.manualChunks to be a function rather than an object — converted accordingly,
with explicit precedence so @xyflow/react (whose name contains the substring
"react") lands in the `flow` chunk instead of being pulled into `vendor`.

Verified locally: npm ci, npm run lint, tsc --noEmit, npm run build, and
npm test (vitest 4.1.8, 3/3 passing) all pass; npm audit reports 0
vulnerabilities.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

frontend/package.json

@@ -33,7 +33,7 @@
     "@eslint/js": "^9.39.4",
     "@types/react": "^19.2.14",
     "@types/react-dom": "^19.2.3",
-    "@vitejs/plugin-react": "^4.2.1",
+    "@vitejs/plugin-react": "^5.2.0",
     "autoprefixer": "^10.4.17",
     "eslint": "^9.39.4",
     "eslint-plugin-react": "^7.37.5",
@@ -43,7 +43,7 @@
     "tailwindcss": "^3.4.1",
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.58.2",
-    "vite": "^5.0.11",
-    "vitest": "^3.0.5"
+    "vite": "^8.0.16",
+    "vitest": "^4.1.8"
   }
 }

frontend/vite.config.ts

@@ -27,10 +27,15 @@ export default defineConfig({
     sourcemap: false,
     rollupOptions: {
       output: {
-        manualChunks: {
-          vendor: ['react', 'react-dom', 'react-router-dom'],
-          charts: ['recharts'],
-          flow: ['@xyflow/react'],
+        // Vite 8 (rolldown) requires manualChunks as a function, not an object.
+        // Order matters: match the more specific packages (@xyflow/react, recharts)
+        // before the generic react match, otherwise '@xyflow/react' — which contains
+        // the substring 'react' — would be pulled into the vendor chunk.
+        manualChunks(id) {
+          if (!id.includes('node_modules')) return;
+          if (id.includes('@xyflow/react')) return 'flow';
+          if (id.includes('recharts')) return 'charts';
+          if (/[\\/]node_modules[\\/]react(-dom|-router|-router-dom)?[\\/]/.test(id)) return 'vendor';
         },
       },
     },