chore(web): lift the jsdom <30.1 Dependabot hold once vitest supports jsdom 30.1 #955

#954 holds jsdom below 30.1 in .github/dependabot.yml. Dependabot cannot report when the hold is no longer needed, so this issue tracks it.

Cause. jsdom 30.1 moved its wrapper impl from an own Symbol(impl) property to a private class field. Vitest's jsdom makeCompatBlob shim finds the impl through the first own symbol. It now finds none and throws Cannot read properties of undefined (reading '_buffer') on every URL.createObjectURL(blob) call. This failed the 5 Login — cached pre-auth banner (#833) tests in #952.

Upstream: reported as vitest-dev/vitest#11336. The fix is vitest-dev/vitest#11353 (open). vitest-dev/vitest#11295 was merged but is not enough on its own because it only handles the _buffer → _bytes rename.

To close this:

1. Wait for a vitest release that includes #11353.
2. On a branch, bump vitest, @vitest/coverage-v8 and jsdom (to the newest 30.x), then run npx vitest run src/routes/Login.test.tsx from web/. All tests must pass.
3. Remove the jsdom ignore block from .github/dependabot.yml in the same PR.

Known cost while the hold is in place: jsdom is dev-only, so the npm audit gate (--omit=dev) does not block on a jsdom advisory. A jsdom fix at 30.1 or later could also be withheld while the ignore rule is active. It has not been checked whether Dependabot applies this rule to security updates.