Update vitest to 5

`vitest` and `@vitest/coverage-v8` stayed on 4.1.11 in the latest dependency sweep. Both must move
together (5.0.0).

## Blockers found

**jest-dom matcher types no longer resolve** — 172 `error TS2339` across the test suite:
`toBeInTheDocument`, `toBeDisabled`, `toBeChecked`, `toHaveAttribute`, `toHaveTextContent`, and
`toHaveValue` all report "does not exist on type `Assertion`". vitest 5 changed the
`Assertion` type, so `@testing-library/jest-dom`'s module augmentation no longer merges in. Needs the
setup file and/or `tsconfig` `types` wiring updated.

**Order-dependent test failure surfaced** — `packages/graph-explorer-proxy-server/src/app.test.ts:311`
intermittently expects status 400 and receives 200 during a full-suite run, while passing when the
file runs alone. vitest 5 reuses workers across files by default, so state that used to be isolated
per file now leaks. It reproduced once and passed on two subsequent full runs, so it's intermittent —
worth tracking down rather than waiting for it to bite CI.

## Acceptance

`pnpm checks` and `pnpm test` pass with vitest and `@vitest/coverage-v8` at 5.x, and the proxy server
app tests pass repeatably in a full-suite run.

> [!IMPORTANT]
> Internal only — this issue is maintained by the core team and is not accepting external contributions.

Start with the test setup file and tsconfig types wiring to resolve the jest-dom matcher errors, then run pnpm checks and pnpm test. Investigate packages/graph-explorer-proxy-server/src/app.test.ts around line 311 in a full-suite run to identify the order-dependent state leak. Done means both Vitest packages are 5.x, checks and tests pass, and the proxy tests pass repeatedly.

Written by the indexing model from the issue text.