chore(deps): bump happy-dom to 21.0.4 past GHSA-834v-8h66-3h79 (dev-only high, needs a major) #2813

Found by the npm audit --audit-level=high report at v2.13.0 release prep (#2812).

clients/web declares happy-dom: ^20.11.2 (installed 20.14.5). GHSA-834v-8h66-3h79, Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution, covers 17.0.0 - 21.0.3. The only patched version is 21.0.4, so no fix exists within the 20.x line.

Scope: dev-only. happy-dom is the web client's unit-test DOM and does not ship in the tarball. The exposure is to whatever HTML or script a test loads into it.

Why this was not fixed at release prep: it needs a major bump (20 → 21). The release skill sends a major to its own issue and PR rather than making it a release-day edit, and npm audit fix --force is ruled out (#2058).

Work:

• Bump clients/web happy-dom to ^21.0.4. It is declared only in web.
• Read the 21.0.0 breaking changes, and fix whatever the web unit and integration suites turn up.
• npm run local:gate.