Refresh generated todo example dependencies for open security alerts

[omridevk]

Problem

The generated React todo example lockfile carries five open Dependabot alerts:

• Alert @napl-lang/grammar should register lowercase language aliases #8: critical, Vitest before 3.2.6
• Alert Attribution / gen provenance metrics #9: high, Vite before 6.4.3
• Alert Rendered NAPL document view on the site #10: medium, Vite before 6.4.3
• Alert Generated-file banner contains an em dash, toolchain-wide #7: medium, Vite before 6.4.2
• Alert deps gate ignores [dev-dependencies] #6: medium, esbuild before 0.25.0

The affected file is examples/todo-app/.napl/src/react/package-lock.json. It is generated state and must not be hand-edited.

Required approach

• Update the owning NAPL source or generation inputs through the language repair workflow.
• Regenerate and install through napl add and napl commit.
• Do not patch .napl/ or its lockfile directly.
• Keep the generated example reproducible.

Acceptance criteria

• Dependabot alerts deps gate ignores [dev-dependencies] #6 through Rendered NAPL document view on the site #10 are resolved.
• The generated example uses patched Vitest, Vite, and esbuild dependency paths.
• Its build and tests pass from generated output.
• The conformance and repository verification batteries remain green.