Bump vulnerable dependencies (46 audit findings)

## Summary

`pnpm audit` reports 46 vulnerabilities (1 critical, 21 high, 20 moderate, 4 low). All are in transitive dependencies.

## Direct deps to bump

| Package | Current | Target | CVEs |
|---------|---------|--------|------|
| `electron` | <40.7.0 | ≥40.8.5 | 15 CVEs incl. critical context isolation bypass (GHSA-jfqg-hf23-qpw2) |
| `vite` | <7.3.2 | ≥7.3.2 | `server.fs.deny` bypass, WebSocket file read, path traversal |

## Transitive deps (require upstream bumps or pnpm overrides)

| Root package | Vulnerable transitive dep | Patched version |
|---|---|---|
| `@datadog/datadog-ci` | `fast-xml-parser` | ≥5.5.7 |
| `@datadog/datadog-ci` | `lodash` | ≥4.18.0 |
| `@datadog/datadog-ci` | `simple-git` | ≥3.32.0 |
| `@datadog/datadog-ci` | `basic-ftp` | ≥5.3.0 |
| `@datadog/datadog-ci` | `axios` | ≥1.15.0 |
| `@datadog/datadog-ci` | `follow-redirects` | ≥1.16.0 |
| `@datadog/datadog-ci` | `brace-expansion` | ≥5.0.5 |
| `@vue/test-utils` | `minimatch` | ≥9.0.7 |
| `eslint` | `flatted` | ≥3.4.2 |
| `@todesktop/runtime` | `picomatch` | ≥2.3.2 |
| `electron-builder` | `picomatch` | ≥4.0.4 |
| `electron-builder` | `@xmldom/xmldom` | ≥0.8.12 |
| `electron-builder` | `brace-expansion` | ≥1.1.13 |

## Suggested approach

1. Bump `electron` and `vite` directly in `package.json`
2. Add `pnpm.overrides` for transitive deps where upstream hasn't bumped yet
3. Run full test suite + build after bumps to verify nothing breaks