fix: deduplicate Three.js while preserving package exports

[atomantic]

Keep 3D components and helper libraries on one Three.js module instance using resolve.dedupe in Vite and Vitest. This preserves package exports and fixes the directory alias regression where RoomEnvironment failed the existing instanceof THREE.Scene assertion.

Validation: seven focused Three.js/avatar test files; client production build; server import-scoping suite (68 tests) after merging current main to pick up its existing import-budget fix. Full CI must pass before merge.

Closes #7066

[atomantic]

CI remains blocked after a failed-job rerun. Both attempts fail in the existing server/lib/importScoping.test.js budget assertion (103,592 static module instantiations vs the 103,240 cap), which then cancels the sibling jobs. This PR changes only client/vite.config.js and client/vitest.config.js, so I did not weaken or broaden the fix to mask the unrelated server-suite regression. The PR is intentionally left open for that CI blocker to be resolved; the issue claim and branch remain in place.

[atomantic]

Claude review completed its configured 1/1 round with exit 0 using enforced Read/Glob/Grep-only tools, plan mode, disabled hooks/MCP/Chrome, and safe/restricted mode. The working tree remained unchanged. Status: no-verdict (optional, inconclusive) because stdout included a prose preamble rather than only the required verdict blocks.

I evaluated the reported suggestions: mapped Three.js subpaths and hoisted installations are hypothetical for this change; current first-party code and the installed fiber/drei/three-stdlib sources have no three/addons, three/webgpu, three/tsl, or three/nodes imports. Existing subpaths are real paths, the avatar test passes without the duplicate-instance warning, and the production build passes. The suggested lockfile test and shared config module are future guards/refactoring without a current wrong outcome, so no review fixes were applied.

CI's cancellation was caused by the server import budget (103,592 against 103,240), not the client alias change. Merged current main, which already includes import narrowing; server/lib/importScoping.test.js now passes all 68 tests without changing its budget. The PR diff against main remains the original two configuration files.

[atomantic]

The next full CI run supplied a concrete regression that the first targeted avatar test missed: threejsEnvironment.test.js failed because RoomEnvironment was not an instance of THREE.Scene. Reproduced locally with the directory alias. Replaced both aliases with resolve.dedupe: ['three'], adopting Claude's proposed mechanism on the basis of this reproduction. The existing environment boundary assertion now passes unchanged, alongside the avatar test without duplicate-instance warnings. No tests were weakened or added to mirror configuration.

Claude remains recorded as optional/no-verdict, 1/1 rounds consumed; the proposed resolution fix is now applied and independently verified. No additional reviewer round is requested under the configured cap.