chore(deps): npm audit fix — resolve 8 dev-dep vulnerabilities

Transitively updated via audit fix (no package.json semver range changes):
- ajv (ReDoS)
- brace-expansion (process hang / memory exhaustion)
- flatted (unbounded recursion DoS)
- hono (XSS via ErrorBoundary)
- picomatch (method injection / ReDoS)
- rollup (arbitrary file write via path traversal)
- vite (path traversal, fs.deny bypass, arbitrary file read)
- yaml (stack overflow via deep nesting)

All 903 tests pass. Build and lint clean.