refactor(vitest): resolve every lane through the tsconfig.base.json facade

tsconfig.vitest.json is deleted; its job (a paths map applying to all
test files) is inherent in tsconfig.base.json having no include —
vite-tsconfig-paths treats that as match-all. All four vitest configs
now pin the same facade: the unit config gains a shared pathsPlugin()
helper, the web lane drops its handwritten webserver alias (apps/web
tests are covered by match-all), and the snapshot lane leaves the root
solution (which no longer carries paths) and stops resolving client
imports through package exports. tsconfig.base.json documents the
facade role and bans include/files; the CI eslint cache key hashes the
four graph tsconfigs; the eslint tests-block comment states resolution
via the solution to tsconfig.host.json.

Per missions/tsconfig-single-graph-migration.md §3.

vitest.web.config.ts

@@ -1,4 +1,4 @@
-import { fileURLToPath } from 'node:url'
+import tsconfigPaths from 'vite-tsconfig-paths'
 import { defineConfig } from 'vitest/config'
 
 // Web smoke lane (GUI, gate-exempt — not part of the CI sequence yet): built
@@ -13,13 +13,10 @@ try {
 }
 
 export default defineConfig({
-  resolve: {
-    alias: {
-      // apps/web/tests is outside the root tsconfig include, so the shared
-      // tsconfig-paths plugin never maps it; alias the one bare import to source.
-      '@deepseek-ai/dsh-host-webserver': fileURLToPath(new URL('packages/host/webserver/src/index.ts', import.meta.url)),
-    },
-  },
+  // Same resolution note as vitest.config.ts: the tsconfig.base.json paths
+  // facade has no include (match-all), so apps/web/tests resolves bare
+  // workspace imports to source like every other lane.
+  plugins: [tsconfigPaths({ projects: ['./tsconfig.base.json'] })],
   test: {
     include: ['apps/web/tests/**/*.e2e.ts'],
     // Browser boot + real-model turns are slow; files share one browser, run serial.