fix: CSS brace balance, upgrade deps (0 vulnerabilities), code-splitting

- Fix: styles.css line 1354 double closing brace (CSS syntax error)
- Upgrade: fastify 5.x, @fastify/cors 11, @fastify/static 9, @fastify/websocket 11
- Upgrade: vitest 4.x, vite 8.x (frontend)
- Result: 0 npm vulnerabilities (was 10 backend + 5 frontend)
- Feature: vite.config.ts manualChunks code-splitting (998kB → 5 chunks, max 451kB)
- All tests pass: Backend 239/239, Frontend 374/374

frontend/package.json

@@ -28,7 +28,7 @@
     "@vitejs/plugin-react": "^4.3.0",
     "jsdom": "^29.1.1",
     "typescript": "^5.5.0",
-    "vite": "^5.4.0",
-    "vitest": "^2.0.0"
+    "vite": "^8.1.3",
+    "vitest": "^4.1.9"
   }
 }

frontend/src/styles.css

@@ -1351,7 +1351,7 @@ a:hover { text-decoration: underline; }
   .tool-section-label { display: block; padding: 0 6px 6px; }
   .tool-btn-label { display: block; }
   .tool-grid { grid-template-columns: repeat(auto-fill, minmax(72px, 1fr)); gap: 4px; }
-  .rightbar { overflow-y: auto; -webkit-overflow-scrolling: touch; }}
+  .rightbar { overflow-y: auto; -webkit-overflow-scrolling: touch; }
 
   /* Right tab bar (vertical icon bar, ALWAYS visible on mobile) */
   .right-tab-bar {

frontend/vite.config.ts

@@ -8,5 +8,22 @@ export default defineConfig({
       '/api': 'http://localhost:3001',
       '/ws': { target: 'ws://localhost:3001', ws: true }
     }
-  }
+  },
+  build: {
+    rollupOptions: {
+      output: {
+        manualChunks(id) {
+          if (id.includes('node_modules/react-dom') || id.includes('node_modules/react/')) {
+            return 'react-vendor';
+          }
+          if (id.includes('node_modules/yjs') || id.includes('node_modules/y-websocket')) {
+            return 'yjs-vendor';
+          }
+          if (id.includes('node_modules/dxf-parser') || id.includes('node_modules/pdf-lib') || id.includes('node_modules/rbush')) {
+            return 'cad-utils';
+          }
+        },
+      },
+    },
+  },
 });