chore(deps): clear vite/esbuild Dependabot alerts via pnpm overrides

[ardelperal]

What

Clears all 4 open Dependabot alerts on the default branch. All are dev-only transitive dependencies (pulled in via vitest), never shipped in the published npm package:

Alert	Sev	Package	Was	Fix
#5	high	vite (server.fs.deny bypass on Windows)	5.4.21	≥ 6.4.3
#6	moderate	vite (launch-editor NTLMv2 disclosure)	5.4.21	≥ 6.4.3
#3	moderate	vite (optimized-deps path traversal)	5.4.21	≥ 6.4.2
#2	moderate	esbuild (dev-server request forgery)	0.21.5	≥ 0.25.0

How

vite/esbuild are not direct deps, so the fix is a pnpm.overrides block forcing the patched floors:

"pnpm": { "overrides": {
  "esbuild@<0.25.0": ">=0.25.0",
  "vite@<6.4.3": ">=6.4.3 <8"
}}

The <8 upper bound keeps vite within vitest@3.2.6's peer range (^5 || ^6 || ^7). Resolves to vite@7.3.6 / esbuild@0.28.1.

Verification

• pnpm audit → No known vulnerabilities found.
• VBA test suites green under vite 7 (290/290 across preprocess/extraction/targets-config).

Only package.json + pnpm-lock.yaml change; no source touched.