build(deps-dev): bump vitest to 5.0.0

[madhavilosetty-intel]

Bumps vitest and @vitest/coverage-v8 to 5.0.0 together, and corrects four test assertions that the upgrade exposes.

Why both packages

@vitest/coverage-v8@5.0.0 declares an exact peer on vitest@5.0.0. Bumping only the coverage package (as #2652 does) fails npm ci:

npm error code ERESOLVE
npm error While resolving: @vitest/coverage-v8@5.0.0
npm error Found: vitest@4.1.11
npm error Could not resolve dependency:
npm error   peer vitest@"5.0.0" from @vitest/coverage-v8@5.0.0

That single error is what fails all four checks on #2652 — both docker build jobs, build (22.x), and Validate PR and Commits (commitlint itself passes there; the job dies at the following npm install step).

Why the test change is in the same commit

Vitest 5 no longer leaks spy state between tests. Four assertions in src/server/webserver.test.ts were counting calls accumulated from earlier tests rather than their own — each creates a fresh spy, calls the method once, then asserts 2, 2, 2 or 3.

These cannot be split into a separate PR: 2/2/2/3 passes only on vitest 4, and 1 passes only on vitest 5. Either half alone turns main red, so they land atomically.

Verification

• npm test — 92 test files, 969 tests pass (was 4 failing)
• npm run build (tsc) — clean
• npm run lint — 0 errors
• npx prettier --check on changed files — clean

[Copilot]

🟡 Changes recommended

Vitest 5 declares a Node engine floor of ^22.12.0 in the lockfile while the repo (and release workflow) still target Node 20, creating a high risk of CI/release installation or runtime incompatibilities.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR upgrades the project’s test runner stack to Vitest 5 (including the tightly-coupled @vitest/coverage-v8 peer) and updates a handful of unit-test assertions in webserver.test.ts that were relying on cross-test spy call accumulation.

Changes:

• Bump vitest and @vitest/coverage-v8 devDependencies to ^5.0.0.
• Update package-lock.json to reflect the Vitest 5 dependency graph.
• Fix four toHaveBeenCalledTimes(...) assertions in src/server/webserver.test.ts to match per-test spy isolation in Vitest 5.

File summaries

File	Description
src/server/webserver.test.ts	Adjusts assertions to match Vitest 5 spy behavior (no cross-test leakage).
package.json	Updates Vitest + coverage devDependencies to 5.0.0.
package-lock.json	Locks the updated dependency tree for Vitest 5 and its new transitive deps.

Review details

• Files reviewed: 2/3 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.