chore(js): bump vitest to 3.2.7 for security advisory

[g4bri3lDev]

Why

Dependabot flags vitest ^2.0.0 as critical: while the Vitest UI server is listening, arbitrary files can be read and executed (fixed in 3.2.6).

Actual exposure is low. It's a dev dependency, and the advisory only applies to vitest --ui, which this repo doesn't use. But the bump is free.

What

• vitest and @vitest/coverage-v8 go from ^2.0.0 to ^3.2.7 (the latest 3.x).
• No config changes needed; vitest.config.ts's WASM plugin works unchanged.
• This deliberately stays on 3.x. vitest 5 exists, but a two-major jump doesn't belong in a security bump; the Dependabot config PR will propose it separately.

Verification

• bun run type-check passes.
• bun run test: 74 passed.
• bun run test:coverage runs.
• bun run build succeeds.

chore:, so no release is triggered.