chore: update dependencies

[flipvh]

Summary

• pnpm cella audit bump, with typescript held at ^6.0.3: typescript 7 has no JS compiler API and crashes @hey-api/openapi-ts during pnpm sdk. Everything else from the audit is kept, including vitest 4 → 5, simplewebauthn 13 → 14, gleap 16 → 17, storybook 10.6, and the new security overrides (tiptap, toml, csv-parse, joi, js-yaml).
• Code adaptations: @types/node 26.5 renamed IntervalHistogram to ELDHistogram; simplewebauthn 14 types WebAuthn transports as an open string list, so the passkey attestation schema and generated SDK follow (the backend never stored transports).
• The csv-parse override forces 7.x on artillery, which dropped the default export and made every bench scenario die inside oclif. The existing artillery pnpm patch now also imports the named parse; the options artillery passes are unchanged in csv-parse 7.
• Bench seed: the attachments mentions text[] column was being JSON-stringified into a malformed array literal. One-line pre-existing fix, separate commit.

Verification

• pnpm check green end to end (sdk gen, all tsgo projects, lens check, biome, style).
• TEST_MODE=core vitest run: 378 files / 2893 tests pass, plus the storybook project (79 files / 421 tests) under vitest 5.
• Playwright 1.63 needs a fresh local browser: pnpm --filter frontend exec playwright install chromium-headless-shell.

Known and left alone

• The bench smoke test (bench/src/tests/all-scenarios.test.ts) is still red whenever a local dev stack is up, and it is skipped in CI. Artillery bundles the TS processors as CommonJS into bench/src/processors/dist, and bench has been "type": "module" since chore: update dependencies #1118, so Node rejects the bundle. Pre-existing on main with main's lockfile, not caused here.
• Peer warnings: @storybook/addon-vitest still declares vitest ^3 || ^4 (runs fine on 5); the tiptap override moves @tiptap/core to 3.31.3 while @tiptap/pm stays 3.30.1. BlockNote's own range covers it and the editor stories pass.

🤖 Generated with Claude Code