build(deps): bump vite 5.4.21 → 6.4.3 to clear the dev-server advisories

All 7 open Dependabot alerts were dev-scope build tooling (vite + esbuild), with
no production-runtime exposure — the deployed app is static assets plus Functions,
neither of which runs vite. vite 6.4.3 patches the three vite dev-server advisories
(GHSA-fx2h-pf6j-xcff high, GHSA-v6wh-96g9-6wx3, GHSA-4w7w-66w2-5vf9) and pulls
esbuild ^0.25.0, clearing GHSA-67mh-4wv8-2f99 transitively.

@vitejs/plugin-react 4.7.0 already lists vite ^6 in its peer range; vitest 3.2.6 is
unchanged. Full gate green; npm audit clean (0 vulnerabilities).

Author: daretodave

apps/web/package.json

@@ -39,7 +39,7 @@
     "@vitest/coverage-v8": "3.2.6",
     "jsdom": "26.1.0",
     "typescript": "5.9.3",
-    "vite": "5.4.21",
+    "vite": "6.4.3",
     "vitest": "3.2.6"
   }
 }