Fix NPM vulnerabilities and add WorthlessCounter to webapp template

[littlebee]

Summary

This PR fixes critical and high severity NPM vulnerabilities in the webapp template and adds a WorthlessCounter example component demonstrating bi-directional state control.

NPM Vulnerability Fixes (Issue #118)

Updated webapp template dependencies to address security vulnerabilities:

• canvas: ^3.0.1 → ^3.2.0
• jsdom: ^26.0.0 → ^27.0.0

Vulnerabilities Fixed:

• ✅ Critical: form-data unsafe random function (GHSA-fjxv-7rqg-78g4)
• ✅ High: tar-fs directory traversal (GHSA-8cj5-5rvv-wf4v)

Results:

• Reduced total vulnerabilities from 9 → 5 (all remaining are moderate dev-only)
• Production dependencies have 0 vulnerabilities
• All remaining vulnerabilities are in esbuild/vite/vitest dev tools only

Test plan

• npm install on fresh project created by bb_create
• npm audit shows reduced vulnerabilities
• npm run build succeeds
• npm test passes

Fixes #118

🤖 Generated with Claude Code

[littlebee]

I tested out the changes on a fresh bb_create project. The "high" and "critical" are both now fixed.

There are still 5 moderate vulnerabilities. These are all originating in esbuild coming up from vitest. The change that Claude recommended for this was to use npm overrides to set the version of esbuild without upgrading vitest.

I'm not sure I like the alternative of upgrading vitest and migrating tests. Ultimately, it will be necessary to upgrade the version of Vite and ViteTest used by the example web app, but this does not feel like the correct PR. That is something that should be planned and have an issue and PR of its own.