fix(docs): cap vite below 7 (rolldown-vite) and pin mermaid transitives

`pnpm docs:dev` failed with two distinct symptoms after #159 forced
vite past its vulnerable 5.x line:

1. VitePress refused to boot with `VitePress v1 is not compatible
   with rolldown-vite. Use VitePress v2 instead.` The previous
   override `vite@<6.4.2 → >=6.4.2` had no upper bound; pnpm
   resolved vitepress's `vite ^5.0.0` constraint up to vite 7.3.2,
   which uses the new rolldown bundler and is explicitly rejected
   by VitePress 1.x.

2. Even when the server eventually booted on a different port, the
   console was flooded with `Failed to resolve dependency: dayjs,
   debug, @braintree/sanitize-url, cytoscape, cytoscape-cose-bilkent`
   — the vitepress-plugin-mermaid wrapper injects those into
   `optimizeDeps.include` but they aren't reachable from the
   workspace root under pnpm's strict isolation (transitives of
   mermaid, never hoisted).

Three changes:

* `pnpm.overrides.vite` is now an **unconditional** `>=6.4.2 <7`
  range (not the previous `<6.4.2 → >=6.4.2` selector). The
  selector form was a no-op once vite had already resolved into
  7.x; the unconditional form forces a downgrade to 6.4.2 across
  every consumer (vitepress, @nx/vite, @analogjs, Vitest). All
  six top-level projects still lint, test, and build.

* `optimizeDeps.include` simplified to `['mermaid']`. Vite 6's
  dep optimizer walks Mermaid's transitives automatically once
  Mermaid itself is included, so the explicit list of children
  the previous fix carried (#157) becomes redundant.

* `dayjs`, `debug`, `@braintree/sanitize-url`, `cytoscape`,
  `cytoscape-cose-bilkent` are pinned as **top-level devDeps**.
  The vitepress-plugin-mermaid wrapper expects them at the
  workspace root; under pnpm's strict isolation a transitive of
  mermaid isn't reachable from a `optimizeDeps.include` lookup
  unless the workspace declares it. Pinning silences the
  resolution warnings without changing the resolved tree (these
  packages were already present via mermaid).

Verification: `pnpm docs:dev` boots clean on :5173, home + ADR
pages return 200, no warnings. `pnpm docs:build` succeeds in ~9 s.
`pnpm audit --audit-level=moderate` reports zero vulnerabilities.
`pnpm exec nx run-many -t lint test build` for the 6 main projects
all pass.

docs/.vitepress/config.mts

@@ -161,18 +161,19 @@ export default withMermaid(
       securityLevel: 'strict',
     },
 
-    // Mermaid 11 ships its `dayjs` / `cytoscape` dependencies with a
+    // Pre-bundle Mermaid through Vite's dep optimizer. When this was
-    // CommonJS `main` field but no `default` ESM export. Vite's dev
+    // first added (#157) Vite 5's dev server resolved Mermaid's CJS
-    // server resolves those modules eagerly as ESM and the browser
+    // transitives (`dayjs`, `cytoscape`, `debug`, `@braintree/sanitize-url`)
-    // throws `does not provide an export named 'default'` on the
+    // eagerly as ESM and the browser threw `does not provide an export
-    // first navigation. Telling `optimizeDeps` to pre-bundle the
+    // named 'default'` on the first navigation. With Vite 6 — to which
-    // Mermaid dependency tree forces the CJS→ESM interop wrapper
+    // we're now pinned per ADR-0022's "stable, recognized" bar (#160
-    // that Vite's Rollup-based build already applies in prod. The
+    // capped vite below 7 because VitePress 1.x rejects the new
-    // production build (`docs:build`) was unaffected even before
+    // rolldown-vite) — the pre-bundler walks Mermaid's transitives
-    // this; this fix is exclusively for the `docs:dev` happy path.
+    // automatically once Mermaid itself is in `include`, so the
+    // explicit list of children has been collapsed.
     vite: {
       optimizeDeps: {
-        include: ['mermaid', 'dayjs', 'debug', '@braintree/sanitize-url'],
+        include: ['mermaid'],
       },
     },
   }),

package.json

@@ -44,7 +44,7 @@
       "ip-address@<10.1.1": ">=10.1.1",
       "protobufjs@<8.0.2": ">=8.0.2",
       "tmp@<0.2.4": ">=0.2.4",
-      "vite@<6.4.2": ">=6.4.2",
+      "vite": ">=6.4.2 <7",
       "yaml@<2.8.3": ">=2.8.3",
       "@types/express": "^5.0.6"
     }
@@ -61,6 +61,7 @@
     "@angular/cli": "~21.2.0",
     "@angular/compiler-cli": "~21.2.0",
     "@angular/language-service": "~21.2.0",
+    "@braintree/sanitize-url": "^7.1.2",
     "@commitlint/cli": "^20.5.3",
     "@commitlint/config-conventional": "^20.5.3",
     "@eslint/js": "^9.8.0",
@@ -96,6 +97,10 @@
     "@vitest/coverage-v8": "~4.1.0",
     "@vitest/ui": "~4.1.0",
     "angular-eslint": "^21.2.0",
+    "cytoscape": "^3.33.3",
+    "cytoscape-cose-bilkent": "^4.1.0",
+    "dayjs": "^1.11.20",
+    "debug": "^4.4.3",
     "eslint": "^9.8.0",
     "eslint-config-prettier": "^10.0.0",
     "eslint-plugin-playwright": "^1.6.2",