fix: update vulnerable build dependencies & update all other deps

[rrbe]

Summary

• update esbuild to 0.28.1 and refresh Vite/PostCSS to patched versions
• update every direct development dependency to its latest release
• upgrade TypeScript to 7.0.2 and explicitly load Chrome types
• resolve all six current Dependabot alerts

Validation

• pnpm install --frozen-lockfile
• pnpm audit --audit-level=low
• pnpm typecheck
• pnpm test
• pnpm build
• pnpm exec oxlint . (one existing warning, unchanged from oxlint 1.56.0)
• pnpm exec oxfmt --check package.json tsconfig.json
• full oxfmt check retains the existing 33-file formatting baseline