v5.2.1

A patch release that refreshes the browser demo's build tools past published advisories. In web/package-lock.json, vite moves from 6.4.3 to 6.4.4 for GHSA-587h-7wmj-h5pm and GHSA-698v-4r3x-3vcv (Windows only) and GHSA-r825-w8mm-5pxw (WSL only) in the launch-editor copy it bundles, and for GHSA-9jrq-w75r-8gcw and GHSA-rq7h-c2jc-7f22; all five concern the development server, not the static site vite build writes. source-map-js moves from 1.2.1 to 1.2.2 for GHSA-68fv-2mgg-jv7q; only postcss loads it, during the build. web/package.json already allowed both versions, and an OSV scan of the pinned packages, the Spring Boot 3.5.16 parent and the Testcontainers BOM included, goes from two vulnerable packages to none.

The services, common/, the migrations, the manifests, the load generator, the README demo block and docs/demo-runs/1bc404c/ are untouched, and the release contains no other commits since 5.2.0. The CI workflow builds and tests the services but has no web job, so the lockfile was checked with npm's lockfile-only tree validation and audit and the OSV scan rather than by a build of the demo. The merge of the release PR passed CI run 40183102376: lint, 36 script cases, the demo block check, 63 Surefire unit tests and 14 Testcontainers integration tests, all passing, and the kind rolling update under load, whose rollout gate printed COVERAGE: PASS and RESULT: PASS.