chore(deps): batch npm bumps (wave 2) (#917)

* chore(deps): batch npm bumps (vite, lucide, zustand, react-virtual, @types/react)

Supersedes Dependabot #905–#907, #909, #911 in one PR to avoid lockfile conflicts.

* chore(nix): sync npmDepsHash with package-lock.json

* chore(ci): retrigger required checks

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

package.json

@@ -30,7 +30,7 @@
     "@fontsource-variable/space-grotesk": "^5.2.10",
     "@fontsource-variable/unbounded": "^5.2.8",
     "@fontsource/opendyslexic": "^5.2.5",
-    "@tanstack/react-virtual": "^3.13.24",
+    "@tanstack/react-virtual": "^3.13.26",
     "@tauri-apps/api": "^2",
     "@tauri-apps/plugin-dialog": "^2.7.1",
     "@tauri-apps/plugin-fs": "^2.5.1",
@@ -42,14 +42,14 @@
     "@tauri-apps/plugin-window-state": "^2.4.1",
     "axios": "^1.16.0",
     "i18next": "^26.0.8",
-    "lucide-react": "^1.14.0",
+    "lucide-react": "^1.17.0",
     "md5": "^2.3.0",
     "papaparse": "^5.5.3",
     "react": "^19.2.5",
     "react-dom": "^19.2.6",
     "react-i18next": "^17.0.6",
     "react-router-dom": "^7.16.0",
-    "zustand": "^5.0.13"
+    "zustand": "^5.0.14"
   },
   "devDependencies": {
     "@tauri-apps/cli": "^2.11.2",
@@ -59,14 +59,14 @@
     "@types/md5": "^2.3.6",
     "@types/node": "^25.6.0",
     "@types/papaparse": "^5.5.2",
-    "@types/react": "^19.2.14",
+    "@types/react": "^19.2.15",
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^6.0.2",
     "@vitest/coverage-v8": "^4.1.7",
     "esbuild": "^0.28.0",
     "jsdom": "^26.1.0",
     "typescript": "^6.0.3",
-    "vite": "^8.0.10",
+    "vite": "^8.0.14",
     "vitest": "^4.1.7"
   }
 }