chore(deps): consolidate compatible dependency updates

[lsiddiquee]

Summary

• Consolidate pending compatible Dependabot npm, Python, Actions, and pre-commit hook updates without new major package migrations.
• Refresh portable pnpm and Poetry lockfiles; resolve transitive fast-uri/postcss advisories and update the playground Vite config for the latest Vite 8.
• Supersedes chore(deps): bump github/codeql-action from 4.37.1 to 4.38.1 #92 chore(deps): bump ruff from 0.15.22 to 0.16.8 #91 chore(deps): bump the development-dependencies group across 1 directory with 12 updates #88 chore(deps): bump the production-dependencies group across 1 directory with 5 updates #85 chore(deps): bump vitest from 4.1.10 to 4.1.11 #84 chore(deps-dev): bump vitest from 4.1.10 to 4.1.11 in /packages/web #83 chore(deps): bump mypy from 2.3.0 to 2.3.1 #73 chore(deps): bump postcss from 8.5.19 to 8.5.25 #67 chore(deps): bump the react group across 1 directory with 4 updates #63 chore(deps): bump docker/login-action from 4 to 4.5.2 #62 chore(deps): bump actions/setup-python from 6.3.0 to 7.0.0 #54 after this PR merges.

Validation

• pnpm -r typecheck, lint, build, test, test:coverage (all passed, coverage >=85%).
• poetry check --lock, ruff check/format, mypy; pre-commit run --all-files.
• Full and production pnpm audit: zero advisories. Python pytest currently discovers no tests in research/.
• Poetry lock artifact hashes checked against official PyPI JSON; Python mirror configuration not committed.