Update dev dependencies to fix security vulnerabilities

[MudassarTariq]

What

This updates the test and build tooling to fix security vulnerabilities. Only devDependencies, overrides, package-lock.json and the CI matrix change.

Package	Change
vitest, @vitest/coverage-v8	^1.0.0 (1.6.1) → ^4.1.11
vite (from vitest)	5.4.21 → 6.4.3, via override
postcss (from vite, tsup and next)	8.4.31 / 8.5.14 → 8.5.28, via override
esbuild (from tsup)	0.27.7 → 0.28.2, via override
sharp (optional dependency of the next dev dependency)	0.34.5 → 0.35.5, via override
nanoid, brace-expansion	refreshed in range

• CI: the matrix now tests Node 20 and 22. vitest 4 requires Node 20+, and Node 18 is end-of-life.
• Package: it has no runtime dependencies, and next stays a peer dependency (>=13.0.0). engines and the published files are unchanged, so nothing changes for users.

Security

• OSV scan of the lockfile: 17 advisories before, 0 after. npm audit: 10 findings (2 critical, 5 high, 3 moderate) before, 0 after.
• The fixes include:
  • the vitest UI arbitrary file read and the @vitest/mocker path traversal (CVE-2026-84373)
  • several vite path-traversal issues and the esbuild dev-server issues
  • several postcss issues
  • the libvips/libheif issues in sharp

No functional change: verification

Check	Before	After
npm run typecheck	pass	pass on Node 20, 22 and 26
npm test	177 passed	177 passed on Node 20, 22 and 26
vitest run --coverage	pass	pass
npm run build, 12 files in dist/		byte-identical
npm pack file list		same files and sizes. Only package.json differs (dev tooling fields)

The coverage percentages printed by --coverage differ slightly, because vitest 4 maps V8 coverage differently. The same 177 tests run, and no coverage threshold is configured.