fix(deps): astro 6 + vitest 3 (clear astro + vitest CVE alerts)

[nbkdoesntknowcoding]

Mirrors the verified astro-6 upgrade from project-x #22 into this public repo, and bumps vitest 2 -> 3 across all packages to clear the 3 CRITICAL vitest Dependabot alerts on apps/api.

Version set (apps/web)

package	before	after
astro	^5.18.2	^6.4.8
@astrojs/node	^9.0.0	^10.1.4
@astrojs/vercel	^9.0.5	^10.0.8
@astrojs/react	^4.0.0	^5.0.7
@astrojs/check	^0.9.4	^0.9.9
@astrojs/sitemap	^3.7.3	^3.7.3 (unchanged)
@sentry/astro	^10.64.0	^10.64.0 (unchanged)

Root pnpm.overrides.vite: 6.4.3 -> 7.3.6 (astro 6 requires vite ^7.3.2; 7.3.6 is above the CVE-patched floor). All other overrides unchanged.

vitest — LANDED

Bumped ^2.x -> ^3.2.7 in apps/web and apps/api. Verified locally under vitest 3:

• @boppl/web test — 22/22 pass
• @boppl/api representative suite against pgvector/pgvector:pg16 + redis:7.4-alpine: round-trip/corpus (51), mcp-tools (8), rls-wrong-tenant (5), round-trip/full-stack (2) — all green

No vitest 2->3 config/API breakage observed. The PR's CI runs the full api suite.

CI

Added a Build workspace packages step (pnpm -r --filter "./packages/**" build) after Install so @boppl/schema / @boppl/shared dist/ resolve during typecheck, migrations, and tests.

Local verification

• pnpm -r --filter "./packages/**" build — pass
• pnpm --filter @boppl/api build (tsc strict) — exit 0
• pnpm --filter @boppl/web build (node standalone + forced Vercel adapter) — both pass
• pnpm --filter @boppl/web test (vitest 3) — pass
• api representative tests (vitest 3) — pass

🤖 Generated with Claude Code