chore(deps): bump js-yaml and markdown-it to resolve security alerts

[B4nan]

Summary

Resolve open Dependabot alerts in impit-node/pnpm-lock.yaml:

• js-yaml 4.1.1 → 4.2.0 (medium)
• markdown-it 14.1.1 → 14.2.0 (medium)
• vite → ^8.0.16 (high + medium) — pinned as a direct devDependency (it's an auto-installed peer of vitest)

Not addressed — needs the Rust toolchain

• pyo3 < 0.29.0 (high + medium, Rust) — impit-python/Cargo.toml pins pyo3 = "0.28" and pyo3-async-runtimes = "0.28". Bumping to 0.29 is a breaking migration (pyo3 0.29 removes IntoPy/into_py in favour of the fallible IntoPyObject, used across ~8 sites) and requires regenerating Cargo.lock and a compile-verify loop. The toolchain wasn't available in this environment, so this is left for a follow-up by someone who can build & test it.

🤖 Generated with Claude Code