chore(deps): refresh npm lockfile for open advisories

[Cristian-Vogel]

In-range refresh of the transitive packages behind the open Dependabot advisories (…). No manifest ranges widened beyond a bumped floor. Before: 58 high / 3 critical Dependabot alerts open. After pnpm audit: 5 high / 1 critical high/critical remaining. Built with pnpm run build; the e2e/ lockfile is untouched. Remaining advisories sit behind the pinned webdriver tooling.

ref https://github.com/crabnebula-dev/dependency-tracking/blob/main/DASHBOARD.md#batch-upgrades

[Cristian-Vogel]

The macOS and Windows test failures are the WebDriver session dropping (Request failed after 3 retries on [data-testid='welcome']), the same signature tauri-driver shows on its own main (https://github.com/crabnebula-dev/tauri-driver/actions/runs/34116846290). This PR only refreshes npm transitives and touches no webdriverio/@wdio package; Linux passes; a rerun reproduced the failure. There is no recent E2E Tests run on main here to compare against (last one 2025-08), so worth a run on main to confirm. Labelled ci:pre-existing-failure so it shows as reviewable on the tracker; the Checks column keeps the red.