chore(#366): harden dev test dependencies

[BorisTyshkevich]

Closes #366.

Follow-up: #372 tracks the eventual Vitest 4 migration. Dependabot keeps temporary major-version ignores for Vitest and its V8 coverage provider only.

What changed

• Upgraded the dev-only test stack to Vitest 3.2.7 (via ^3.2.6) and Happy DOM 20.11.0.
• Refreshed the lockfile, including the patched transitive dependency graph.
• Added a CodeMirror cross-document-realm regression test exposed by the Happy DOM upgrade.
• Updated Dependabot's obsolete 2.x / paired-Happy-DOM policy and removed its Happy DOM major-version ignore.
• Documented the remediation under Unreleased.

Why

npm audit reported critical advisories in the prior Vitest/Happy DOM versions. Vitest 4 was evaluated but its changed V8 coverage accounting fails the repository's existing per-file coverage gate across many established modules. Vitest 3.2.7 contains the security fix and retains the compatible coverage model.

This changes local/CI tooling only; no test-runner code is included in the shipped artifact.

Validation

• npm audit --json — 0 vulnerabilities
• npm test — 160 files / 4,679 tests, coverage gate passes
• npm run build — passes
• npm run test:e2e — one Chromium visual-test flake; the same test passed in Firefox/WebKit and immediate Chromium retry passed