build(deps): combined major bumps (web react19/vite8/router7, server fastify/drizzle)

Combina los bumps de Renovate abiertos en 1 PR (1 pasada de CI):
web: react 18→19, react-dom 18→19, react-router-dom 6→7, @dnd-kit/sortable 9→10,
  @vitejs/plugin-react 4→6, vite 6→8, @types/react 18→19
server: @fastify/cors 10→11, @fastify/static 8→9, drizzle-orm 0.36→0.45, drizzle-kit 0.28→0.31, vitest 2→4

EXCLUIDO typescript v6 (#6): salto 5→6 rompe tsc, queda como duda.
Verificado local (node:24): server 'tsc' OK; web 'tsc && vite build' OK. Sin cambios de código.
Sustituye PRs #1,#2,#3,#4,#7,#8,#9,#11,#12,#13.

server/package.json

@@ -11,19 +11,19 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@fastify/cors": "^10.0.1",
-    "@fastify/static": "^8.3.0",
-    "drizzle-orm": "^0.36.4",
+    "@fastify/cors": "^11.0.0",
+    "@fastify/static": "^9.0.0",
+    "drizzle-orm": "^0.45.0",
     "fastify": "^5.1.0",
     "nanoid": "^5.0.9",
     "postgres": "^3.4.5",
     "socket.io": "^4.8.1"
   },
   "devDependencies": {
-    "drizzle-kit": "^0.28.1",
+    "drizzle-kit": "^0.31.0",
     "socket.io-client": "^4.8.1",
     "tsx": "^4.19.2",
     "typescript": "^5.7.2",
-    "vitest": "^2.1.8"
+    "vitest": "^4.0.0"
   }
 }