chore(deps): bump vulnerable dependencies (CRITICAL/HIGH)

[samlown]

Summary

Bumps the following packages to resolve Dependabot CRITICAL/HIGH security advisories:

Package	Previous Version	New Version	Type	Severity
vitest	2.1.9	3.2.6	direct devDependency	HIGH
devalue	5.7.0	5.8.1	transitive (override)	HIGH
esbuild	0.25.12	0.28.1	transitive (override)	CRITICAL

Changes

• Bumped vitest from ^2.1.8 to ^3.2.6 in devDependencies
• Added npm overrides for devalue (>=5.8.1) and esbuild (>=0.28.1) to pin transitive dependencies

Verification

• Install gate: PASSED — npm install completed successfully
• Build gate: FAILED (pre-existing issue unrelated to these changes) — vite build fails with Could not resolve "./helpers.js" on both the base branch and this branch. This is a pre-existing build issue.
• Tests: Not run due to build gate failure

Notes

Build failure is pre-existing on main and not caused by these dependency bumps (verified by confirming failure on the unmodified base branch).

Generated to remediate Vanta-tracked Dependabot vulnerabilities.

[netlify]

❌ Deploy Preview for popui-svelte failed. Why did it fail? →

Name	Link
🔨 Latest commit	93cf21d
🔍 Latest deploy log	https://app.netlify.com/projects/popui-svelte/deploys/6a3027979db1f40008decaaa