Dependency migrations: TypeScript 7, Tailwind 4, Vite 8 (deliberate, not auto-merge)

[silverstein]

Dependabot opened major bumps that are real migrations, not safe auto-merges. Tracking them so they're done deliberately with proper testing instead of merged red or left rotting.

• TypeScript 5.9 → 7.0 (site chore(deps): bump typescript from 5.9.3 to 7.0.2 in /site #544, sdk chore(deps): bump typescript from 5.9.3 to 7.0.2 in /crates/sdk #539, mcp chore(deps): bump typescript from 5.9.3 to 7.0.2 in /crates/mcp #537). chore(deps): bump typescript from 5.9.3 to 7.0.2 in /crates/mcp #537 already fails CI — the mcp build doesn't compile under TS7 yet, so this needs code changes, not a version bump. Do all three workspaces together.
• Tailwind CSS 3 → 4 (site chore(deps): bump tailwindcss from 3.4.19 to 4.3.3 in /site #543). A config + rendering migration; even if it builds, it needs visual QA against DESIGN.md (cream/coral/green, Instrument/Geist fonts, no drift). Do not merge without a visual pass.
• Vite 7 → 8 (mcp chore(deps): bump vite from 7.3.6 to 8.1.5 in /crates/mcp #538, fails CI). The MCP dashboard build needs updating for Vite 8.

Each should be a hand-authored PR with its own testing, superseding the dependabot auto-PR. The dependabot PRs stay open as version pointers but must not be merged as-is.