fix(security): patch 4 Dependabot alerts (happy-dom RCE + vite file read)

[vybe]

Summary

GitHub Dependabot flagged 4 critical/high severity vulnerabilities on main. All are in dev-only dependencies with patched versions already available.

Alerts

#	Severity	Package	Manifest	Patched in	Vulnerability
#83	critical	happy-dom	tests/git-sync/package-lock.json	20.0.0	VM Context Escape → RCE (CVE-2025-61927)
#55	high	vite	src/frontend/package-lock.json	6.4.2	Arbitrary file read via dev-server WebSocket (CVE-2026-39363)
#84	high	happy-dom	tests/git-sync/package-lock.json	20.8.8	ECMAScriptModuleCompiler code exec (CVE-2026-33943)
#85	high	happy-dom	tests/git-sync/package-lock.json	20.8.9	Fetch credentials cookie leakage (CVE-2026-34226)

Context

Surfaced during the dev-workflow rollout push on 2026-04-24. Neither package ships to production:

• happy-dom is a test-only dependency (browser simulation for tests/git-sync/)
• vite serves the frontend in local dev only — production builds are static and don't run the dev server

Blast radius is contained, but the alerts should be cleared.

Acceptance Criteria

• Bump happy-dom to ≥ 20.8.9 in tests/git-sync/package-lock.json (resolves Agent Meta Process Mining — autonomous agent review and optimization recommendations #83, Test Coverage Gaps: Avatars, Rate Limits, Payments, and test-runner.md sync #84, MCP schedule tools missing timeout_seconds, allowed_tools, and model parameters #85)
• Bump vite to ≥ 6.4.2 in src/frontend/package-lock.json (resolves Agents page: filtering by tags, status, and name #55)
• npm install clean in both directories; tests pass locally
• All 4 Dependabot alerts close automatically after merge
• No new critical/high alerts introduced by transitive bumps

Technical Notes

• happy-dom may need a multi-major jump — run the tests/git-sync/ suite to verify compatibility
• Check @vitejs/plugin-vue / other vite peer deps for matching bumps
• The 27 moderate alerts (axios and others) are out of scope — track separately if needed

[vybe]

Merged via #486 into dev (commit 619f2f6). 4 Dependabot alerts resolved.