build: bump vitest past GHSA-5xrq-8626-4rwp; coverage-v8 everywhere

pnpm audit --prod --audit-level=critical (the new CI gate) failed on
vitest <3.2.6 (critical, arbitrary file read/execute via the UI
server). Bump vitest + @vitest/coverage-v8 in-range across the
workspace and add @vitest/coverage-v8 to every package that runs
vitest but lacked it (core-audit, core-cms, core-eslint, core-testing,
core-trpc, apps/cms, web-next, web-tanstack, turbo/generators) so
'pnpm test -- --coverage' works in every package. No compound test
scripts exist, so the vitest-last pass-through concern does not apply.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

packages/core-testing/package.json

@@ -25,16 +25,16 @@
     "test": "vitest run"
   },
   "dependencies": {
+    "@tanstack/react-query": "^5.59.0",
     "@testing-library/jest-dom": "^6.5.0",
-    "zod": "^3.23.0",
     "@testing-library/react": "^16.0.0",
     "@testing-library/user-event": "^14.5.0",
     "@trpc/client": "^11.0.0",
-    "@tanstack/react-query": "^5.59.0",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
     "superjson": "^2.2.0",
-    "vitest": "^3.0.0"
+    "vitest": "^3.2.7",
+    "zod": "^3.23.0"
   },
   "peerDependencies": {
     "@trpc/server": "^11.0.0",
@@ -54,6 +54,7 @@
     "@sentry/nextjs": "^10.51.0",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
+    "@vitest/coverage-v8": "^3.2.7",
     "jsdom": "^25.0.0",
     "typescript": "^5.8.0"
   }