fix(deps): resolve open Dependabot alerts

[drewstone]

Summary

Resolve the three open Dependabot alerts. No alert is dismissed.

Alert	Package	Severity	Manifest	From	To	Advisory
#17	esbuild	low	package-lock.json	0.27.7	0.28.1	GHSA-g7r4-m6w7-qqqr
#30	esbuild	low	pnpm-lock.yaml	0.27.7	0.28.1	GHSA-g7r4-m6w7-qqqr
#44	postcss	medium	pnpm-lock.yaml	8.5.18	8.5.23	GHSA-fxqj-rqcc-2cmp

Changes

• package.json: add esbuild: 0.28.1 to pnpm.overrides and to npm overrides. tsup 8.5.1 declares esbuild ^0.27.0, so neither lockfile can reach 0.28.x without the pin. vite 8.0.16 accepts ^0.27.0 || ^0.28.0.
• package.json: raise the postcss override from 8.5.18 to 8.5.23 (first patched version).
• pnpm-lock.yaml: regenerated with pnpm install. Only esbuild, @esbuild/*, and postcss entries change.
• package-lock.json: regenerated with npm install --package-lock-only --ignore-scripts. The lockfile on main did not satisfy the vite: 8.0.16 pin in package.json (npm ci fails with lock file's vite@8.2.2 does not satisfy vite@8.0.16), so npm also moves vite 8.2.2 -> 8.0.16 and its rolldown dependencies to match the manifest. package-lock.json postcss stays at 8.5.26 (already patched).

Verification

All commands run from the branch with Node 22.21.0, pnpm 10.28.0, npm 10.9.4.

Command	Result
pnpm install --frozen-lockfile	exit 0
pnpm run typecheck	exit 0
pnpm run test	exit 0, 26 files, 453 tests passed
pnpm run build	exit 0, ESM + DTS build success
pnpm audit	No known vulnerabilities found
npm ci --dry-run --ignore-scripts	exit 0, lockfile in sync with package.json
git merge-tree --write-tree origin/main HEAD	clean

Resolved versions in pnpm-lock.yaml: esbuild@0.28.1, postcss@8.5.23.
Resolved versions in package-lock.json (npm ls --package-lock-only): esbuild@0.28.1 overridden, postcss@8.5.26, vite@8.0.16.

Note

The repository tracks two lockfiles (pnpm-lock.yaml, package-lock.json) while CI and packageManager use pnpm only. Each advisory produces two alerts, and npm does not read pnpm.overrides, so the two lockfiles drift. Dropping package-lock.json would remove the duplicate alert stream; that is a separate decision and is not part of this PR.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Hd9Ww3YmftNEs9DnRtQQ84