Update portal demo dependencies and fix the CodeQL alerts

[zeevmoney]

Consolidates the open Dependabot PRs and fixes all nine open CodeQL alerts in permit-portal-demo.

Dependencies (Dependabot #1–#5)

PR	Change
#1	lucide-react 1.51.0 → 1.52.0
#2	@types/supertest 6.0.3 → 7.2.1
#3 + #4	vite 7.3.6 → 8.3.1 with @vitejs/plugin-react 5.2.0 → 6.1.1 (v6 needs vite 8)
#5	Not applied: the demo runs on Node 24, so @types/node stays on 24.x. .github/dependabot.yml now ignores its major versions.

Vite 8 builds with Rolldown, so the vendor chunk moves from rollupOptions.output.manualChunks to rolldownOptions.output.codeSplitting.groups. The build output is the same (vendor chunk 436 kB, no warnings). plugin-react 6 drops Babel, which removes the @babel/* packages from the lockfile.

Dependabot should close #1–#4 once this is merged. #5 can be closed by hand.

CodeQL alerts

Alert	Rule	Fix
#7, #8, #9	js/missing-rate-limiting	express-rate-limit 8.7.1, mounted first in createApp: 3,000 requests a minute per client address, in front of every route and the SPA fallback. The demo's own peak (panel polling, page refreshes, scenario runners) is about 1,000 a minute. trust proxy stays off, so a client can't choose its own key.
#1–#5	js/bad-tag-filter	The tests that pull the inline <script> out of the app's own HTML match it case-insensitively.
#6	js/incomplete-multi-character-sanitization	The test helper that reads button labels captures the text after the icon instead of stripping tags with replace.

Two new tests check the RateLimit-Policy header on every route and the 429 { error: 'Too many requests' } answer. Both fail without the limiter.

express-rate-limit 8.7.1 is MIT and outside the range of its one advisory. Its new transitive dependency, ip-address 10.7.4, and Rolldown's native packages are less than 7 days old; they pass the repo's 24-hour pnpm release-age policy.

Checks run

• pnpm install --frozen-lockfile, pnpm peers check and pnpm audit --audit-level=moderate: clean.
• pnpm lint (oxlint, oxfmt, tsc): passes.
• pnpm test: 863 tests pass.
• pnpm run build:web: no warnings.
• Both Docker images build. The portal image boots and answers /healthz with the RateLimit-Policy header.
• Vite 8's dev proxy adds no X-Forwarded-For header.

CodeQL wasn't run locally. This PR's CodeQL check should show #1–#9 as fixed.

🤖 Generated with Claude Code

https://claude.ai/code/session_01ARnk1jhjwpyA9h4PmTsabQ