chore(deps): bump four npm packages in one branch

[htcom-code]

Dependabot opened two PRs against the same base commit (834cbf7): #64 (production, 1 package) and #65 (development, 3 packages). Merging them one at a time would make the other wait for a rebase and burn a second CI round, so this consolidates both into a single green tree.

What changed

Production (from #64)

package	from	to
lucide-react	1.46.0	1.47.0

Development (from #65)

package	from	to
@types/node	26.6.1	26.6.2
jsdom	30.0.1	30.1.1
oxlint	1.83.0	1.85.0

The rest of the lock diff is transitive under jsdom (@asamuzakjp/css-color, @asamuzakjp/dom-selector, @csstools/*, bidi-js, html-encoding-sniffer, undici, w3c-xmlserializer, whatwg-url) and the @oxlint/binding-* platform packages. symbol-tree drops out because jsdom 30.1 no longer depends on it; nothing in this repo imports it. No direct majors — every direct bump stays inside its existing semver range.

Lock integrity

The two branches merged without conflict, so the lock was not regenerated: it is exactly the union of the #64 and #65 locks. lucide-react is the 1.47.0 Dependabot verified; there is no drift to pin back.

Verification on the merged tree

• npm run lint: clean. The 7 only-export-components warnings are the same ones already on main, so oxlint 1.85 adds none.
• npm run build: ok. The output bundle is byte-identical to main (index-v-UcBT-i.js, 520.11 kB / gzip 164.32 kB), because the new icons are unused and tree-shaken.
• npm test: 17 files / 199 tests pass, run 4 times in a row with no failures (the known quota-pressure flake did not show up).
• jsdom 30.1 adds a QuotaExceededError class. use-trace-store.ts classifies errors with instanceof DOMException, which the new class still satisfies. The storage-failure, retention-limit and quota-pressure suites all pass.

Not caused by this PR

npm audit reports 6 advisories (4 moderate, 2 high: fast-uri, hono, ip-address, js-yaml, qs, undici). main at 834cbf7 reports the same 6, all dev-only. This PR actually narrows one: jsdom's nested undici moves 8.10.0 -> 8.11.0, out of the 8.1.0 - 8.10.1 range. The remaining undici hit is a different copy on 7.x. Tracked separately.

Closes #64
Closes #65