chore(deps): bump pnpm to 12.11.2 and pull in the weekly batch early

[joszz]

Summary

• pnpm 12.6.0 to 12.11.2. Dependabot cannot bump packageManager (dependabot-core#4830), so this pin only moves by hand.
• Monday's Dependabot batch, early. Everything released before 2026-10-09 05:00 UTC, which is what the 3-day cooldown would let through on Monday 07:00:

Ecosystem	Updates
Frontend	vite 8.3.4, vite-plugin-pwa 2.0.0, maplibre-gl 6.13.0, vue-router 5.4.0, vue-i18n 11.4.13, eslint 10.12.0, oxlint + eslint-plugin-oxlint 1.87.0, @playwright/test 1.64.0, jsdom 30.1.2
NuGet	Scalar.AspNetCore 2.17.14
Actions	actions/setup-node v7.1.0, github/codeql-action v4.38.3

vite-plugin-pwa 2.0.0 is a major only because it widens the @vite-pwa/assets-generator peer range to ^2. This project does not use that package, so it is a drop-in. The service worker still builds (61 precache entries).

Left for Dependabot next week (still inside the cooldown)

vue-tsc 3.3.13, prettier 3.9.10, vue-i18n 11.4.14, @types/node 26.6.5, @vitejs/plugin-vue 6.0.10, xunit.v3 4.0.2, xunit.runner.visualstudio 4.0.1.

Still held on purpose

• TypeScript 7: 7.1 has no beta yet, only nightly dev builds.
• Microsoft.OpenApi 3.x: still incompatible with Microsoft.AspNetCore.OpenApi.
• pmOnFail: ignore: dependabot-core#15904 is still open, and the lockfile is still a single YAML document.

Test plan

• pnpm install --frozen-lockfile --config.minimum-release-age=1440 (CI's release-age gate)
• pnpm run lint, prettier --check src/ e2e/
• pnpm run build (type-check + vite build + service worker)
• Frontend unit tests: 850 passed
• Backend build (0 warnings) and tests: 889 passed
• E2E smoke test with Playwright 1.64 (CI)

🤖 Generated with Claude Code