Fix Dependabot security alerts

[slashdevcorpse]

Summary:

• Upgrades the direct dependency surface for Vite, TanStack Start/Router, Tailwind/Vite tooling, Nitro nightly, Wrangler, and ws.
• Adds pnpm overrides for vulnerable transitive ranges that remain in the lockfile graph: ajv, brace-expansion, flatted, h3, minimatch, picomatch, postcss, rollup, srvx, undici, ws, and TanStack server core.
• Regenerates pnpm-lock.yaml so the dependency graph resolves outside the 38 GitHub Dependabot alert ranges.

Validation:

• pnpm -C apps/codex-claw test
• pnpm -C apps/codex-claw build
• pnpm -C apps/landing build
• pnpm pack:codex-claw
• pnpm audit --audit-level low
• git diff --check

Alert tracking:
Closes #18
Closes #19
Closes #20
Closes #21
Closes #22
Closes #23
Closes #24
Closes #25
Closes #26
Closes #27
Closes #28
Closes #29
Closes #30
Closes #31
Closes #32
Closes #33
Closes #34
Closes #35
Closes #36
Closes #37
Closes #38
Closes #39
Closes #40
Closes #41
Closes #42
Closes #43
Closes #44
Closes #45
Closes #46
Closes #47
Closes #48
Closes #49
Closes #50
Closes #51
Closes #52
Closes #53
Closes #54
Closes #55

---

Summary by cubic

Fixes all current Dependabot security alerts by upgrading and pinning dependencies across apps/codex-claw and apps/landing. Regenerates pnpm-lock.yaml and adds pnpm overrides to force patched versions of vulnerable transitives.

• Dependencies
  • Upgrade vite to ^7.3.3; @tailwindcss/vite and tailwindcss to ^4.3.0.
  • Upgrade TanStack packages (@tanstack/react-router, @tanstack/react-start, @tanstack/router-plugin, @tanstack/react-router-ssr-query, @tanstack/react-router-devtools) to ^1.167+.
  • Pin nitro nightly to 3.0.1-20260529-064703-255b254f.
  • Upgrade wrangler to ^4.95.0 and ws to ^8.21.0.
  • Add pnpm overrides for vulnerable ranges: @tanstack/start-server-core, ajv, brace-expansion, flatted, h3, minimatch, picomatch, postcss, rollup, srvx, undici, ws.

^{Written for commit ac80a28. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 4 files

<sub>Tip: cubic can generate docs of your entire codebase and keep them up to date. Try it here.

Re-trigger cubic</sub>

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.