Fix CVEs: upgrade vulnerable transitive and direct dependencies

[mraible]

Updates resolutions and direct devDependencies to resolve open Dependabot security alerts.

Dependencies upgraded:

• axios: 1.15.2 -> 1.16.0 (Proxy-Authorization leaks, ReDoS, prototype pollution, resource exhaustion)
• vite: 7.3.2 -> 7.3.5 (server.fs.deny bypass, launch-editor NTLMv2 hash disclosure)
• tar: 7.5.11 -> 7.5.16 (PAX size override file smuggling)
• ws: added 8.21.0 override (memory exhaustion DoS, uninitialized memory disclosure)
• shell-quote: added 1.8.4 override (newline injection in .op values)
• form-data: added 4.0.6 override (CRLF injection via multipart field names)
• js-cookie: added 3.0.7 override (prototype hijack cookie-attribute injection)
• brace-expansion: 5.0.5 -> 5.0.6 (numeric range DoS)
• tmp: 0.2.4 -> 0.2.6 (path traversal via unsanitized prefix/postfix)
• js-yaml: 4.1.1 -> 4.2.0

Build output (dist/) regenerated with the updated vite version. All unit tests pass.