Upgrade vitest and @vitest/coverage-v8 to 5 together #285

Split from #277. Dependabot major PRs for vitest and @vitest/coverage-v8 are ignored in .github/dependabot.yml (#282) until this is done.

Background

vitest and @vitest/coverage-v8 pin exact peers on each other (currently 4.1.12), so a major bump of one cannot install without the other. A standalone @vitest/coverage-v8 5 PR therefore fails. They have to move in lockstep, and a vitest 5 upgrade may also need a matching vite version.

Blocker

A deliberate decision to adopt vitest 5, once its release and vite compatibility are understood.

Work

• Review the vitest 5 migration notes and its vite requirement
• Bump vitest and @vitest/coverage-v8 together (and vite if required) and refresh the lockfile
• Fix any test, mock or config breakage
• Remove the vitest and @vitest/coverage-v8 ignore entries from the npm block in .github/dependabot.yml (and vite if it moved)

Acceptance criteria

• npm ci, npm run lint, npm run type-check, npm run test -- --run --coverage and npm run build pass in TaskFlow.Web (coverage stays at or above the 80% line threshold)
• The security-scan.yml web image build passes
• Dependabot can open vitest major PRs again

Related: #277