bump dev and example dependencies to clear security advisories

[fabracht]

Clears all 20 open Dependabot alerts. Every alert was in dev/test tooling or the example apps — the published package surface (npm audit --omit=dev) was already clean and is unchanged.

Changes

Main repo

• @vitest/browser, @vitest/browser-playwright, @vitest/ui, vitest ^4.1.5 → ^4.1.10 — clears the two critical @vitest/browser advisories (browser-mode RCE / unsanitized inline script).
• overrides: { uuid: ^11.1.1 } — forces the fixed uuid past vite-plugin-top-level-await's pinned uuid@10 (the plugin only uses uuid v4; the advisory affects v3/v5/v6 with a buf arg, so this is non-exploitable here — the override just clears the alert).
• npm audit fix pulled fixed transitive vite (≥8.0.16, server.fs.deny bypass + launch-editor) and ws (≥8.21.1, memory-exhaustion DoS).

Examples (react, vue, vanilla)

• vite ^7.1.12 → ^7.3.6 — clears the vite high+medium advisories.
• overrides: { uuid: ^11.1.1 }; npm audit fix pulled fixed esbuild / @babel/core.

Verification

• npm audit (full and --omit=dev) = 0 vulnerabilities across the main repo and all three examples.
• Main: tsc clean, eslint clean, 30 tests pass (confirms the vitest 4.1.10 bump + uuid override don't break the wasm-loading browser test path).
• All three examples build with the wasm bundled.

No runtime/published dependency changed; consumers are unaffected.