Deferred dependency updates that need source changes

## Description

A broad dependency sweep brought most of the tree to the latest versions, but seven package updates
were held back because each one needs source changes rather than just a version bump. This epic
collects those follow-ups so they can be picked off one at a time instead of blocking a routine
update round.

Everything that updated cleanly is already done — this is only the remainder.

## High-Level Plan

Each child is independent and can land on its own:

- oxc toolchain (`oxlint`, `oxfmt`, `oxlint-tsgolint`) — newer versions report violations to fix
- `vitest` 5 — matcher types no longer resolve, plus an order-dependent test failure it exposes
- `jotai` 3 — a removed import subpath and the type errors that follow from it
- `crypto-js` — deprecated upstream with no newer version, so it has to be replaced

Ordering suggestion: the oxc toolchain and `crypto-js` work are self-contained. `vitest` 5 and
`jotai` 3 both need investigation before the size of the change is clear.

## Related Issues

- Children are linked as sub-issues below

> [!IMPORTANT]
> Internal only — this issue is maintained by the core team and is not accepting external contributions.