Consolidate September routine dependency updates

[DRAZY]

Summary

• consolidate the five currently open Dependabot proposals into one current-main lockfile update
• update docx to 9.7.1, JSZip to 3.10.2, Vue to 3.5.42, axe-core to 4.13.0, vue-tsc to 3.3.11, and Vitest to the 5.0 line
• align Audio-V declared Node development range with Vitest 5 supported runtimes
• synchronize source, release documentation, and defect evidence as v0.4.46
• select the unified NSIS 3.12 toolset so Windows packaging remains reproducible on Apple Silicon build hosts

Why consolidated

The individual bot PRs overlap in package.json and package-lock.json. One coordinated PR avoids stale lockfile merges and repeats the native platform/parity checks once.

Local verification

• clean npm ci under supported Node 22.22.0
• npm audit and npm audit --omit=dev: 0 vulnerabilities
• 42 test files / 204 tests passed on Vitest 5.0.1
• typecheck and production builds passed
• accessibility, responsive layout, spectrogram, comparison, identity, acceptance, corpus, format, Oracle worker, CLI, and defect gates passed
• platform snapshot passed
• Apple Silicon DMG, Universal DMG, Windows installer, and Windows portable package built locally
• macOS and Windows artifact verification passed
• four-package SHA-256 manifest verified
• release-candidate automated readiness: 17/17 passed

Supersedes #4, #16, #17, #18, and #19 once protected checks pass.