chore: apply npm audit fix, drop unused ts-jest, and typecheck in CI

[khusseini]

Two independent maintenance fixes found during a repository health review.

1. Dependency security (9f7dd0b)

Runs npm audit fix — no --force, no breaking changes — and removes the unused ts-jest devDependency.

Notable fixes:

• vitest 3.2.4 → 3.2.7 — GHSA-5xrq-8626-4rwp, critical: arbitrary file read/exec while the Vitest UI server is listening
• vite 6.4.2 → 6.4.3 (server.fs.deny bypass)
• ws → 8.21.1, plus undici, esbuild, postcss, js-yaml, @babel/core

This advisory was previously addressed by Dependabot PR #47 (vitest 3.2.6 → 4.1.8), which was closed unmerged — presumably to avoid the v4 major. That left the patch unapplied, and is why the Dependabot Updates workflow has been re-firing daily on the same ever-growing package list without ever landing anything. The patch-level bump to 3.2.7 fixes the advisory without the major.

ts-jest was left over from before the migration to vitest — it is referenced nowhere in the codebase and there is no jest config. It was the sole root of the entire jest dependency chain, worth ~16 further advisory entries.

On the audit numbers

The raw npm audit total goes up (31 → 50), which is misleading. npm reports one entry per affected package node, not per advisory, so the few remaining roots fan out across many dependents once the tree is re-resolved. Measured like-for-like on the lockfile:

	before	after
distinct root advisories	18	6
critical	3	1

The remaining critical is tar inside the npm CLI vendored within semantic-release. Clearing it requires npm audit fix --force, which would downgrade @semantic-release/npm from ^13.1.5 to 4.0.2 — not worth it for release-time tooling that never reaches published dist.

2. Typecheck in CI (4378b69)

The test job ran only npm run test:coverage, so vue-tsc never ran in CI. npm run build (which does emit declarations) runs only in the release job — i.e. after tests pass, on a push to a release branch. A PR that broke types went green and only failed at release time.

Adds a typecheck script and runs it before the test suite.

Verification

Locally, against the updated dependency tree:

• npm run typecheck — exit 0
• npm test — 180/180 passing, 20 files
• npm run build — exit 0
• workflow YAML parses

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.
see 2 files with indirect coverage changes

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

🎉 This PR is included in version 1.1.0-beta.1 🎉

The release is available on:

• GitHub release
• v1.1.0-beta.1

Your semantic-release bot 📦🚀