chore(frontend): remediate development audit findings

[JustinPerea]

What changed

• Pins Vite to the non-vulnerable 8.0.16 release.
• Overrides vulnerable transitive @babel/core, brace-expansion, js-yaml, and undici versions.
• Keeps the two brace-expansion majors compatible with their respective minimatch parents.
• Pins the existing Browserslist toolchain so lockfile regeneration cannot select releases younger than 14 days.

Package-age policy

Every upgraded package in the resulting lockfile was checked against npm publication metadata and was at least 14 days old. Five unrelated Browserslist data releases between 0 and 13.6 days old were rejected and pinned to the existing eligible versions. No npm audit fix was run.

Validation

• Clean npm ci --ignore-scripts: 402 packages installed.
• Full npm audit: 0 findings.
• npm audit --omit=dev: 0 findings.
• Frontend: 50 files and 392 tests passed.
• Lint and production build passed.
• Existing non-blocking large-chunk and lottie-web direct-eval warnings remain.
• git diff --check and staged credential scans passed.
• No paid provider calls ran.