fix: CSS brace balance, upgrade deps (0 vulnerabilities), code-splitting

- Fix: styles.css line 1354 double closing brace (CSS syntax error)
- Upgrade: fastify 5.x, @fastify/cors 11, @fastify/static 9, @fastify/websocket 11
- Upgrade: vitest 4.x, vite 8.x (frontend)
- Result: 0 npm vulnerabilities (was 10 backend + 5 frontend)
- Feature: vite.config.ts manualChunks code-splitting (998kB → 5 chunks, max 451kB)
- All tests pass: Backend 239/239, Frontend 374/374

frontend/vite.config.ts

@@ -8,5 +8,22 @@ export default defineConfig({
       '/api': 'http://localhost:3001',
       '/ws': { target: 'ws://localhost:3001', ws: true }
     }
-  }
+  },
+  build: {
+    rollupOptions: {
+      output: {
+        manualChunks(id) {
+          if (id.includes('node_modules/react-dom') || id.includes('node_modules/react/')) {
+            return 'react-vendor';
+          }
+          if (id.includes('node_modules/yjs') || id.includes('node_modules/y-websocket')) {
+            return 'yjs-vendor';
+          }
+          if (id.includes('node_modules/dxf-parser') || id.includes('node_modules/pdf-lib') || id.includes('node_modules/rbush')) {
+            return 'cad-utils';
+          }
+        },
+      },
+    },
+  },
 });