Fix Dependabot security alerts (vite upgrade + lockfile refresh)

[devin-ai-integration]

Summary

Resolves all open Dependabot alerts (brace-expansion, postcss, js-yaml, shell-quote, form-data, qs, body-parser, @babel/*, vite, diff) across the three manifests.

• server/client: bump vite ^5.4.19 → ^6.4.3 and @vitejs/plugin-legacy ^5.4.3 → ^6.1.1 (vite fixes require v6.4.3; plugin-legacy 6.x is the vite-6 line). Client builds cleanly on vite 6.
• Root and server/ lockfiles regenerated so all transitive advisories resolve to patched versions (incl. diff 4.0.2 → 4.0.4 under ts-node).

npm audit reports 0 vulnerabilities in all three manifests; npm run build (client) and tsc (server) pass.

Link to Devin session: https://app.devin.ai/sessions/f43afc6587eb4551ac490388df723498

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring