Merge open dependency PRs, fix GitHub Actions security workflows, and polish underwater visuals

[Copilot]

Summary

• Merged all currently open Dependabot PR branches into this branch: deps-dev(deps-dev): bump vite-plugin-pwa from 1.2.0 to 1.3.0 #343, deps-dev(deps-dev): bump @types/three from 0.184.0 to 0.184.1 #344, deps-dev(deps-dev): bump @typescript-eslint/eslint-plugin from 8.59.1 to 8.59.2 #345, deps-dev(deps-dev): bump vite from 8.0.10 to 8.0.12 #346, deps-dev(deps-dev): bump @typescript-eslint/parser from 8.59.1 to 8.59.2 #347, deps-dev(deps-dev): bump lighthouse from 13.1.0 to 13.3.0 #348
• Fixed the Dependabot GitHub Actions workflow by granting contents: write for auto-merge and pinning dependabot/fetch-metadata to a commit SHA
• Fixed the failing CI Security Scan by remediating a high-severity transitive vulnerability in package-lock.json (@babel/plugin-transform-modules-systemjs updated to 7.29.4)
• Improved graphics ambience by increasing sea creature population, weighting fish spawns, and refining fish visuals/animation behavior

Validation

• npm run lint
• npm run build
• npm run test
• npm run format:check
• npm run test:e2e (passes; includes 2 flaky retries in settings modal mobile background tap test)
• npm audit --audit-level=high (passes with 0 vulnerabilities)
• parallel_validation run completed with Code Review feedback addressed; CodeQL reported success initially, then a later rerun timed out per tool budget guidance

[github-actions]

🎮 PR Preview Deployed

Your PR has been deployed to a preview environment with multiple deployment options!

🌐 Web Preview (GitHub Pages)

🌊 Play the preview: https://commjoen.github.io/3dgame/pr-349/
📋 All previews: https://commjoen.github.io/3dgame/previews.html

🐳 Container Preview (GHCR)

Run the PR preview locally using Docker:

# Option 1: PR-specific tag
docker run -p 8080:80 ghcr.io/commjoen/3dgame:pr-349

# Option 2: Commit-specific tag  
docker run -p 8080:80 ghcr.io/commjoen/3dgame:5b3a60a

# Then visit: http://localhost:8080

📦 Container Registry: View all tags

---

Both previews will be automatically updated when you push new commits to this PR.
The container images support both linux/amd64 and linux/arm64 architectures.

[commjoen]

@copilot can you fix the failing GitHub action please?

[Copilot]

@copilot can you fix the failing GitHub action please?

Fixed in 5b3a60a. I traced the failing Security Scan to npm audit --audit-level=high and updated package-lock.json to remediate the vulnerable transitive package (@babel/plugin-transform-modules-systemjs -> 7.29.4). Local npm audit --audit-level=high now reports 0 vulnerabilities; if checks still show action_required, please approve/rerun the workflow in GitHub UI.