fix(security): vitest/react-router/ws/vite CVE cluster — bump Node deps

Fix 10 advisories across 4 packages:
- vitest 3.2.4 → 3.2.6: GHSA-5xrq-8626-4rwp (Critical: arbitrary file exec)
- react-router-dom 7.12.0 → 7.18.0: 7 GHSAs (XSS/CSRF/DoS cluster, worst >=7.15.1)
- ws override >=8.21.0: GHSA-58qx + GHSA-96hv (memory disclosure + DoS)
- vite 6.4.2 → 6.4.3: GHSA-fx2h-pf6j-xcff (server.fs.deny bypass)

pnpm-lock.yaml regenerated; pnpm audit confirms 0 critical/high remaining.

Refs: NSPECT-S62Q-PZUD (collection)
Refs: NSPECT-UV6I-R3V9 (child)
Generated-by: agentic-cve-fix
Signed-off-by: NVIDIA Security Bot <security-bot@nvidia.com>

Author: NVIDIA Security Bot

frontend/package.json

@@ -21,7 +21,7 @@
     "marked": "^15.0.12",
     "react": "^19.1.0",
     "react-dom": "^19.1.0",
-    "react-router-dom": "^7.12.0",
+    "react-router-dom": "^7.15.1",
     "uuid": "^11.1.0",
     "zustand": "^5.0.5"
   },
@@ -36,8 +36,8 @@
     "@types/react": "^19.1.2",
     "@types/react-dom": "^19.1.2",
     "@vitejs/plugin-react": "^4.4.1",
-    "@vitest/coverage-v8": "^3.2.4",
-    "@vitest/ui": "^3.2.4",
+    "@vitest/coverage-v8": "^3.2.6",
+    "@vitest/ui": "^3.2.6",
     "eslint": "^9.25.0",
     "eslint-plugin-react-hooks": "^5.2.0",
     "eslint-plugin-react-refresh": "^0.4.19",
@@ -46,8 +46,8 @@
     "tailwindcss": "^4.1.11",
     "typescript": "~5.8.3",
     "typescript-eslint": "^8.30.1",
-    "vite": "^6.3.5",
-    "vitest": "^3.2.4"
+    "vite": "^6.4.3",
+    "vitest": "^3.2.6"
   },
   "resolutions": {
     "@kui/foundations": "./src/assets/kui-foundations-react-external-0.504.1.tgz"
@@ -58,7 +58,9 @@
       "minimatch@3.1.2": "3.1.4",
       "minimatch@9.0.5": "9.0.7",
       "picomatch": ">=4.0.4",
-      "flatted": ">=3.4.2"
+      "flatted": ">=3.4.2",
+      "ws": ">=8.21.0",
+      "vite": "^6.4.3"
     }
   }
 }