chore(deps-dev): bump vitest, @vitest/coverage-v8 and @vitest/ui from 3.2.7 to 4.1.11 in /services/web-app

[AlexeyShalaev]

Dependabot's #72 moved vitest to 4.1.11 and left @vitest/coverage-v8 and @vitest/ui at 3.2.7. Both peer-pin the exact vitest version, and vitest 4 dropped vite-node, so the 3.x coverage provider dies in V8CoverageProvider.convertCoverage reading fetchCache off a vitenode object that no longer exists. That is the TypeError: Cannot read properties of undefined (reading 'fetchCache') in "Frontend · Tests"; vitest says as much right above the crash: Loaded vitest@4.1.11 and @vitest/coverage-v8@3.2.7. Running mixed versions is not supported.

What moved. vitest, @vitest/coverage-v8, @vitest/ui -> ^4.1.11, lockfile regenerated with pnpm 9.15.9 (what CI installs). Nothing else had to move: vite 6.4.3 satisfies vitest 4's ^6 || ^7 || ^8 peer range, @vitejs/plugin-react-swc 4.3.3 and jsdom 26.1.0 stay where master has them, and vitest 4.1.11 (expect-type: ^1.3.0) still resolves expect-type@1.4.0, so the pnpm patch keeps applying (1.4.0 is upstream's latest and still ships no exports).

One config line. coverage.include: ["src/**/*.{ts,tsx}"] in vitest.config.ts. Vitest 4 removed coverage.all; by default only files imported during the run are counted, which would have lifted the frontend flag on codecov from ~10% to ~58% without a single new test. The include pins the denominator back to the whole source tree, which is what the existing exclude list was written against. There are no .js/.jsx files under src/, so the set is the same one 3.x reported.

What I ran, on Node 22.23.2 (CI's major, via npx -p node@22; local default is 26) with pnpm@9.15.9, in services/web-app:

• baseline on master, pnpm install --frozen-lockfile && pnpm test:coverage: RUN v3.2.7, Test Files 9 passed (9), Tests 93 passed (93), All files 9.96.
• after the bump, pnpm install then pnpm test:coverage: RUN v4.1.11, Test Files 9 passed (9), Tests 93 passed (93), no mixed-version warning, All files 11.77 (same file set; v4's AST-based remapping counts lines a bit differently; without include it printed 57.88).
• pnpm lint: clean. pnpm typecheck: clean.

Replaces #72.