Refresh lockfile to resolve npm audit findings

[bmtriet]

Summary

• refresh package-lock.json so vitest resolves to 4.1.8
• clears the current npm audit findings for vitest, vite, @vitest/mocker, and esbuild
• leaves package.json unchanged because the existing ^4.0.18 range already permits the patched version

Context

This follows up on #4. I kept this to a lockfile-only update so the dependency change stays narrow.

Verification

• npm ci
• npm audit --audit-level=moderate
• npm run test:unit -> 15 files / 187 tests passed

This is a lightweight public dependency-audit fix, not a certified security audit. No private credentials or account access were used.