chore(deps): update 18 dependencies within their current major

[austenstone]

Stacked on #109 (needs that .npmrc first, otherwise npm install rewrites the lockfile back to the corporate mirror).

React 19.2.4 → 19.2.8, Vite 8.0 → 8.2, Vitest 4.1.2 → 4.1.10, plus Primer, TanStack Virtual, papaparse, fflate, prettier, typescript-eslint and the React type packages. All within their existing major.

On version selection

This machine has min-release-age=7 configured globally — a supply-chain control that refuses any version published in the last 7 days, which is the window that matters for a compromised-package attack. I targeted the newest release older than 7 days rather than overriding the policy. Six packages are therefore one patch behind npmjs latest, deliberately:

package	taken	npmjs latest	held because
@primer/react	38.35.1	38.36.0	< 7 days old
@tanstack/react-virtual	3.14.9	3.14.10	< 7 days old
@testing-library/user-event	14.6.4	14.6.5	< 7 days old
@vitejs/plugin-react	6.0.5	6.1.0	< 7 days old
@vitest/coverage-v8	4.1.10	4.1.11	< 7 days old
vite	8.2.1	8.2.2	< 7 days old

They'll be eligible in a few days. Recording it here so nobody reads those as arbitrary pins.

One deliberate hold

eslint-plugin-react-hooks stays at 7.0.1. 7.1.x adds react-hooks/set-state-in-effect, which fails on three existing effects:

App.tsx:83                setState inside a mount effect reading ?demo=
InsightsSidebar.tsx:108
usePageNavigation.ts:98   auto-switch page when a new report is added

The rule is correct — these are genuine cascading-render patterns. But they're all "synchronize two pieces of state" effects, and fixing them properly is a React restructure that needs browser re-verification, not a --fix. usePageNavigation.ts in particular was just changed in #106. Bundling a behavioral refactor into a routine dependency bump is how regressions ship unnoticed, so it gets its own PR.

Verification

Lint clean, typecheck clean, 286 tests pass, build succeeds, coverage unchanged at 88.24 / 73.3 / 88.11 / 90.85. Lockfile still resolves entirely to npmjs.org.

Not included

Nine majors are held for separate evaluation: @tanstack/react-table 8→9, highcharts 12→13, eslint 9→10, jsdom 29→30, typescript 5.9→7.0, and others. TypeScript 7 is the Go-native compiler rewrite and is nowhere near a drive-by bump.