chore(deps): bump vitest to 5.0.0 across all workspaces

[bighadj22]

What

One coordinated bump of the vitest family in all three workspaces at once (a single root lockfile + vitest 5's exact @vitest/* peer pins make per-package bumps unmergeable — that's why #92–#97 were closed):

Package	Change
vitest	4.1.11 → 5.0.0 (cod-server, cod-client-astro, theme01)
@vitest/ui	4.1.11 → 5.0.0 (cod-server, theme01)
@vitest/coverage-v8	4.1.11 → 5.0.0 (cod-server)
fast-uri (transitive)	3.1.5 → 3.1.7 — supersedes #85

Compatibility checks (pre-verified locally)

• vitest 5 peers vite ^6.4.0 || ^7.0.0 || ^8.0.0 — root Vite pin (^8.2.2) untouched, npm ls vite shows a single vite@8.2.2 everywhere
• vitest 5 engines node ^22.12.0 || ^24 || >=26 — CI runs node 24 ✓
• Migration-guide risk audit of the codebase came back clean: no deprecated entrypoint imports (vitest/environments etc.), no bench(), no snapshots, no expect.poll, no test.sequential, no VITEST_POOL_ID usage
• clearMocks now defaults to true in v5 — the whole suite passes without setting it back
• better-auth's optional vitest peer resolves to a nested 4.1.11 copy; each workspace's vitest binary resolves to 5.0.0 (verified with vitest --version in all three)

Verification (local, on this branch)

Package	Typecheck	Tests
cod-server	✓	118 files / 1709 tests passed
cod-client-astro	✓	33 files / 142 tests passed
theme01	astro check ✓	2 files / 10 tests passed

Contributor notes (vitest 5 behavior changes that apply here)

• npm run test:ui now requires the token-authenticated URL vitest prints at startup
• test:ci's json/html reporters now write to .vitest/ instead of stdout/html/ (script isn't referenced by CI or other tooling)
• vitest no longer looks up configs from parent directories (each workspace has its own config — unaffected)

Follow-up (not in this PR)

• vitest-environment-miniflare in cod-server devDeps appears unused (no docblocks/imports anywhere in src) — candidate for removal in a separate cleanup