Bump esbuild to 0.28.1 for GHSA-g7r4-m6w7-qqqr

The advisory covers arbitrary file read when running esbuild's
development server on Windows. This project only ever invokes esbuild as
a bundler through esbuild.config.mjs, never its serve mode, so the
practical exposure was nil -- but the pin is exact, so the advisory
could not clear without an explicit bump. Patch-level change; the
production build and full unit suite are unaffected.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>