[PAMulligan]

Closes #79. Replaces #89, which was merged into the #83 branch after #83 had already landed on main, so its commits never reached main; this is the same two commits replayed onto current main.

What changed

• Root: the unused vitest devDependency is gone (it was committed only to stop a local fast-forward conflict; nothing at the root uses it). The root lockfile is now empty. pnpm audit: no known vulnerabilities.
• App, dev tooling only: vitest and @vitest/coverage-v8 3.2.4 → 5.0.5 (vite stays on 6.4.x, which vitest 5 supports), the other devDependencies updated within their ranges (vite 6.4.5, crxjs 2.7.1, eslint 9.39.5, postcss 8.5.31, sharp 0.35.5, typescript 5.9.3, @playwright/test 1.64.1), the vulnerable transitive packages re-resolved, and @types/node made explicit because vitest 4 stopped pulling it in. Every runtime dependency (react, react-dom, zustand, jose, @anthropic-ai/sdk, tailwind-merge, clsx, lucide-react, canvas-confetti) resolves to the same version as on main, so the shipped bundle is unchanged.
• Two test adjustments for vitest 4+ semantics: the Anthropic SDK constructor mock is a function (mocks really construct under new now), and the three store-action mocks in ai.test.ts carry the store's own function types.

Audit

Lockfile	Before (on main)	After
root	3 critical, 13 high, 13 moderate, 2 low	none
app	3 critical, 42 high (eslint, postcss, crxjs, sharp, ws, vite chains)	0 critical, 0 high, 1 moderate

The one moderate is postcss-selector-parser 6.x pinned by tailwindcss 3.4 (postcss-nested), patched only in 7.1.6; it needs Tailwind 4 or a major-version override and is left as is.

Verification

pnpm -C app lint            clean
pnpm -C app tsc --noEmit    clean
pnpm -C app test            545 passed (32 files)
pnpm -C app build           ok
pnpm -C app test:e2e        26 passed (headed Chromium, local)
pnpm audit --audit-level high   exit 0 in app/ and at the root

Note on the issue's third acceptance item: Dependabot alerts are enabled on the repo but automated security fixes are off, so Dependabot opens no security PRs either way.

🤖 Generated with Claude Code