fix(dev-1376): bump vitest to 4.1.11

[spur-vuln-author]

Context

GHSA-82fw-gwwq-j7x9 affects vitest < 4.1.11 (Dependabot alert #7, package-lock.json). No dedicated Dependabot PR exists for this specific finding — Dependabot's own PR #11 ("Bump @vitest/mocker and vitest") bundled a vitest bump into the separately-tracked @vitest/mocker finding (DEV-1320, PR #12), and PR #9/PR #10 (DEV-1312) cover the package.json-scoped vitest alert (#5), not this package-lock.json-scoped one (#7). Per the vulnerability-remediation policy, findings differing only by manifest/scope are separate units of work with their own PR, so this is constructed directly from the alert's own first_patched_version (4.1.11) rather than reused from a sibling PR. This is a major-version bump (3.x → 4.x), so it is flagged high-scrutiny: major-bump and is not eligible for direct merge. vitest is a devDependency only (test toolchain), so runtime/production risk is limited to the test suite.

Test evidence

No Dependabot PR existed for this specific alert; constructed from first_patched_version 4.1.11 via npm install vitest@4.1.11 --legacy-peer-deps (the plain npm install hit a pre-existing @npmcli/arborist peer-resolution bug — TypeError: Cannot read properties of null (reading 'edgesOut') — in this environment; --legacy-peer-deps is npm's standard, non-guessing workaround for that resolver bug, not a change to the target version). Companion-file scan (companion-scan.sh package-lock.json 3.2.7) found no hits. CI will run on this PR.

Risk

Low. DevDependency-only major bump; no application code changes. Advisory GHSA-82fw-gwwq-j7x9, severity medium, SLA 180 days (Tier 1), due 2027-03-10. spur-vuln-review must give final sign-off given the major-bump flag before merge.

---

[spur-vuln-reviewer]

high-scrutiny-major-bump: this PR bumps vitest to 4.1.11, a major-version bump (GHSA-82fw-gwwq-j7x9, package-lock.json). Per ADR-0003, major-bump findings are never auto-merge eligible regardless of CI/diff cleanliness — CI is passing and the diff appears scoped to the manifest/lockfile, but that does not change the outcome. Not merged. A human must review this. This reviewer will not act on this PR again.
[[spur-vuln-reviewer: escalated high-scrutiny-major-bump]]

[spur-vuln-author]

spur-vuln-remediate note (dedup-check pass): flagging for spur-vuln-review before merge. PR 12 (fix/dev-1320) already bumps this same package-lock.json vitest resolution from 3.2.7 to 5.0.0, which independently satisfies this finding's first_patched_version of 4.1.11. This PR instead bumps vitest to 4.1.11 while leaving @vitest/mocker at 3.2.7. Merging both 12 and 13 will leave package-lock.json inconsistent (mismatched vitest/@vitest-mocker majors, or a merge conflict) depending on order. Recommend merging only one of 12/13 for this manifest and closing the other as superseded. Also: this PR still carries the hitl label; hitl is meant for ticket-only findings with no PR, and this session's sandbox denies gh pr edit so the label could not be removed here -- needs a human to clear it, same limitation already noted on PR 12 and PR 10.