fix(deps): bump vitest to 3.2.6 (GHSA-5xrq-8626-4rwp)

[WomB0ComB0]

Summary

Closes the only open Dependabot critical alert: GHSA-5xrq-8626-4rwp — "When Vitest UI server is listening, arbitrary file can be read and executed" (vulnerable range < 3.2.6).

• vitest 3.2.4 → 3.2.6
• @vitest/coverage-v8 3.2.4 → 3.2.6 (kept lockstep with vitest, as required)

Patch bump within 3.2.x — no behavior change. Dev-only dependency (not shipped in the published package).

Test plan

• bun add -d vitest@3.2.6 @vitest/coverage-v8@3.2.6 — installs clean, bun.lock regenerated
• bun run test (vitest) — 170/170 pass, exit code 0

Only package.json + bun.lock change.

[github-actions]

👋 Hi @WomB0ComB0, thanks for the pull request! A scan flagged some concerns with it. Could you please take a look?

[pr-task-completion] This PR's body is missing [x] checks on the following tasks from the PR template.

• Addresses an existing open issue: fixes #000
• That issue was marked as status: accepting prs
• Steps in CONTRIBUTING.md were taken

Repositories often provide a set of tasks that pull request authors are expected to complete. Those tasks should be marked as completed with a [x] in the pull request description. Please complete those tasks and mark the checks as [x] completed.

[pr-linked-issue] This pull request is not linked as closing any issues. This repository keeps to GitHub issues for discussing potential changes. Most or all changes should be marked as approved in an issue before a pull request is sent to resolve them. To resolve this report:

• If this is a straightforward documentation change that doesn't need an issue, you can ignore this report
• If there is a backing issue, add a 'fixes #...' link to the pull request body
• Otherwise, file an issue explaining what you'd like to happen

🗺️ This message was posted automatically by OctoGuide: a bot for GitHub repository best practices.