chore(deps): clear Dependabot alerts via lockfile regen + vitest v4 bump

[jung-thomas]

Summary

Following the OSPO-driven enablement of Dependabot security updates in #35, GitHub surfaced 64 vulnerabilities that had been silently accumulating in stale lockfiles. This PR clears the bulk of them.

What changed

Manifest	Before	After	Action
solution/MyHANAApp/package-lock.json	6 (1🔴 2🟠 3🟡)	0 ✅	Regenerated. Upstream @sap/cds-dk dropped its axios transitive dep, eliminating the 39-alert axios chain.
solution/MyHANAApp/app/router/package-lock.json	10 (6🟠 4🟡)	2 🟠	Regenerated. Two residual axios-via-approuter alerts deferred (see below).
docs/package.json + docs/package-lock.json	17 (1🔴 6🟠 10🟡)	4 🟡	Regenerated. Bumped vitest ^2.1.9 → ^4 (semver-major) to fix the critical vitest CVE; verified all 23 unit tests still pass and npm run docs:build succeeds.
Total	33 local / 64 GH alerts	6 local	Bulk regen + targeted dev-tool bump.

🔴 critical · 🟠 high · 🟡 moderate

What's left and why

2 alerts in AppRouter (axios via @sap/approuter@21)

@sap/approuter 21.x transitively pins an old axios. The fix requires @sap/approuter@22, a semver-major bump that may affect routing config. This is a workshop-content change deserving its own validated PR (re-test exercise 5/8 with the live AppRouter, confirm xs-app.json and mta.yaml destination routing). Will open a follow-up issue.

4 alerts in docs (esbuild → vite → vitepress chain)

• esbuild GHSA-67mh-4wv8-2f99 — dev server CORS issue
• vite path-traversal in .map handling — dev server only
• Both flow up through vitepress and vitepress-plugin-mermaid (no fix available; vitepress 1.6.4 is latest stable).

Risk: these only manifest while running npm run docs:dev and an attacker can already reach localhost on the developer's machine. The production output of npm run docs:build (the static site we deploy) is unaffected. Will dismiss in Dependabot as tolerable risk – dev server only with a note to re-evaluate when vitepress 2.x lands.

Verification done

• npm audit before/after captured for every manifest (numbers in the table above)
• docs/: npm test → 23/23 passing on vitest v4
• docs/: npm run docs:build → success, no errors
• solution/MyHANAApp/: cds compile srv → success
• Pre-existing ESLint errors in OPA test files (unrelated to lockfiles) confirmed by stash-and-rerun; not addressed here.

No source-code changes

Only lockfile regen and the single vitest devDependency bump. Workshop participant experience is unchanged for any exercise that uses these dependencies — they'll just install fresher transitive versions.