chore(deps): bump six npm packages in one branch

[htcom-code]

Why

Dependabot opened #67 (production, 1 update) and #68 (development, 5 updates) against the same base. Both touch package.json and package-lock.json, so merging one would force a rebase and a second CI round on the other. This consolidates both into a single green tree.

What

Package	From	To	Group
lucide-react	1.47.0	1.49.0	production
@types/node	26.6.2	26.6.3	development
vite	8.3.0	8.3.1	development
vitest	5.0.1	5.0.3	development
@vitest/coverage-v8	5.0.1	5.0.3	development
oxlint	1.85.0	1.86.0	development

• All minor or patch, no breaking changes in the release notes. lucide-react only adds icons and marks @types/react as an optional peer.
• vitest and @vitest/coverage-v8 move together, so the exact peer pin resolves.
• The rest of the lock diff is the oxlint platform bindings, @oxc-project/types and the vite/vitest transitive tree.

Lock integrity

The two Dependabot branches merged with no conflicts, so the lock is the exact union of the #67 and #68 locks. It was not regenerated, so nothing drifted past what Dependabot pinned (lucide-react stays at 1.49.0).

Verification (merged tree)

• npm ci: OK
• npm run lint: exit 0, 7 warnings, the same only-export-components set as main
• npm run build: passes. Main JS 520.11 -> 520.06 kB (gzip 164.32 -> 164.28)
• npm test: 17 files, 199 tests pass
• npx vitest run --coverage: 199 tests pass. CI never runs coverage, so this is the only check on the @vitest/coverage-v8 bump

Not introduced by this PR

npm audit reports the same 16 findings on this branch as on main. Most come through shadcn and are dev-only. With --omit=dev, one high remains (source-map-js, GHSA-68fv-2mgg-jv7q). It comes in through @tailwindcss/vite / vite / postcss and runs only at build time, so it does not ship in the browser bundle. It will be handled separately.

Closes #67
Closes #68