fix: bump vite override to ^7.3.5 to fix GHSA-fx2h-pf6j-xcff

[mishushakov]

Resolves Dependabot alert #172 (CVE-2026-53571 / GHSA-fx2h-pf6j-xcff), a high-severity server.fs.deny bypass in the Vite dev server on Windows. Bumps the pnpm vite override from ^7.3.2 to ^7.3.5, re-resolving the transitive dependency to 7.3.6. The lockfile re-resolution also pulls forward vite's dependency tree: vitest/@vitest/* 4.1.9 → 4.1.10, postcss 8.5.17 → 8.5.22, and esbuild (for vite) to 0.28.0. Verified with a clean pnpm install --frozen-lockfile.

🤖 Generated with Claude Code

[cursor]

PR Summary

Low Risk
Dependency-only override and lockfile refresh with no application source changes; main risk is minor toolchain behavior differences from Vite/Vitest patch bumps.

Overview
The root pnpm.overrides entry for vite is raised from ^7.3.2 to ^7.3.5 so the tree resolves to a patched Vite (lockfile shows 7.3.6) for GHSA-fx2h-pf6j-xcff / CVE-2026-53571 (server.fs.deny bypass on Windows dev server).

pnpm-lock.yaml is regenerated: transitive vitest and @vitest/* move to 4.1.10, postcss to 8.5.22, and Vite’s bundled esbuild shifts to 0.28.0 while dropping the unused esbuild@0.27.7 platform packages.

^{Reviewed by Cursor Bugbot for commit c461e2c. Bugbot is set up for automated code reviews on this repo. Configure here.}