[sebin-gg]

Summary

• Replace the vulnerable Create React App toolchain with Vite and Vitest; this removes the full react-scripts dependency tree and leaves npm audit clean.
• Pin every GitHub Action to an immutable commit, limit this repository to the four actions it uses, require SHA pinning, and keep the default workflow token read-only.
• Preserve the existing Dependabot check gate while queueing merges through GitHub auto-merge.

Verification

• sfw npm test — 1 test passed.
• sfw npm run build — passed.
• sfw npm audit --audit-level=low — 0 vulnerabilities.
• Vite preview smoke check — HTML and production JS both returned HTTP 200.
• actionlint and git diff --check — passed.