chore: upgrade vitest to 4.x (#685)

Upgrades the Vitest suite to 4.x. This obviates the closed Dependabot PR
#684, which bumped only `@vitest/browser` to 3.2.5 — an unmergeable
target, since `vitest@3.2.5` is a broken release (its required
`vite-node@3.2.5` dependency was never published).

No test code changes needed. Our tests don't use features affected by v4
breaking changes.

### Tests & Checks
- Clean `rm -rf node_modules package-lock.json && npm i` resolves at
vitest **4.1.9** with no peer conflicts
- tests pass

Author: aganders3