chore(deps): refresh project dependencies and build toolchains

[stackia]

Summary

Refresh the JavaScript and Python dependency locks and the build/release toolchain to current releases.

• Upgrade pnpm 11.25.0 → 12.3.4, Vitest 4.1.11 → 5.0.0, and VitePress 2.0.0-alpha.19 → alpha.20. Update lucide-react, Biome, Node/React DOM types, and compatible transitive dependencies.
• Upgrade Ruff 0.16.5 → 0.16.6 and basedpyright 1.39.10 → 1.40.0. Align the pytest minimum with the already locked 9.1.1 version.
• Update GitHub Actions to current release tags, including pnpm/action-setup 6.1.0 with pnpm 12 support. Use concrete release versions because some upstream major tags are absent or lag behind the latest release.
• Upgrade Alpine 3.22 → 3.24, OpenWrt SDKs 24.10.4 → 24.10.8 and 25.12.0 → 25.12.5, and the musl cross-toolchain 20250929 → 20260823 (GCC 16.2.0).

Node remains on Active LTS Krypton and Python on 3.14. VitePress continues on the existing prerelease channel. Customized vendored C sources and the generated embedded frontend header are unchanged.

Validation

• Frozen pnpm and uv installs; no outdated direct JavaScript or locked Python dependencies reported.
• Type checks, Ruff, clang-format, and Biome pass. Biome reports one CSS specificity warning; the documentation build reports unsupported url/m3u highlighting languages.
• Frontend tests: 28 passed. Production frontend and documentation builds passed.
• macOS Release C build and full E2E suite: 626 passed; both test collection entry points passed.
• Alpine 3.24 arm64 image built and served /status successfully (HTTP 200).
• Updated x86_64 musl toolchain: static Release build and executable smoke test passed.
• actionlint passed; all 14 referenced action tags and all 38 OpenWrt SDK image tags resolve.
• pnpm audit: zero known vulnerabilities.
• PR CI passed: Linux, macOS, and FreeBSD E2E; type checks/lint; documentation build/deployment; CodeQL analysis.

OpenWrt package builds and the remaining release architecture combinations are not exercised locally; the SDK image tags and all nine musl toolchain assets were verified.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_4aa9b48c-f9e1-4f5a-9ac6-5ee872438e07)

[github-actions]

Documentation preview

The documentation preview has been deployed for this pull request.

• Preview: https://thankful-water-0a297bf00-753.eastasia.1.azurestaticapps.net
• Commit: d483a36