fix(security): patch pytest tmpdir and vite path-traversal advisories

[hubertlim]

Summary

Resolves the 4 open Dependabot security advisories.

Changes

Advisory	Package	Before	After
GHSA-6w46-j5rx-g56g	pytest	8.4.2	9.0.3
GHSA-6w46-j5rx-g56g	pytest-asyncio	0.26.0	1.4.0
(compatibility)	pytest-cov	5.0.0	7.1.0
GHSA-4w7w-66w2-5vf9	vite	^5.2.12	^6.4.2
GHSA-67mh-4wv8-2f99	esbuild (transitive)	< 0.25	>= 0.25 (via vite 6)
(compatibility)	vitest	^1.6.0	^2.1.9
(compatibility)	@vitejs/plugin-react	^4.3.0	^4.7.0

Risks

• pytest 9 is a major bump but the test suite uses standard pytest patterns that v9 supports.
• vite 6 is a major bump, mostly internal changes; the build and dev server configuration in vite.config.ts is unchanged.
• vitest 2 moves to vite 6 as the underlying engine.

Verification

• All 17 backend tests pass with pytest 9
• All 4 frontend tests pass with vitest 2
• Production build succeeds (vite v6.4.2 building for production... ✓ 33 modules transformed)
• Backend dependency lock regenerated with --require-hashes integrity
• Frontend lockfile regenerated