Track removal of temporary esbuild override after Vite compatibility catch-up

[TimeToBuildBob]

The overrides.esbuild = 0.28.1 pin added in #867 is a temporary security workaround.

Current state:

• vite@6.4.2 declares esbuild support as ^0.25.0, so Dependabot could not lift esbuild to the patched line on its own.
• Forcing esbuild@0.28.1 required setting build.target = 'es2022' in vite.config.js because esbuild 0.28.x no longer lowers one destructuring pattern to the old default browser targets.

Exit criteria:

• Re-evaluate after upgrading Vite to a version that officially supports newer esbuild releases, or after replacing the workaround with a cleaner dependency update.
• Remove the explicit overrides.esbuild pin if the dependency tree resolves to a patched esbuild version without it.
• Revisit whether the explicit build.target = 'es2022' compatibility knob is still needed once the override is gone.

Follow-up from: #867

[TimeToBuildBob]

Re-evaluated the exit criteria (2026-06-14) — the override must stay; removing it now would reintroduce a security vulnerability.

Current dependency reality:

• aw-webui is on vite@^6.4.2, which declares esbuild as ^0.25.0.
• Two new esbuild advisories have landed since fix(deps): override esbuild to patched version #867, both patched only in 0.28.1:
  • GHSA-gv7w-rqvm-qjhr — vulnerable range >= 0.17.0, < 0.28.1
  • GHSA-g7r4-m6w7-qqqr — vulnerable range >= 0.27.3, < 0.28.1
• Without the overrides.esbuild = 0.28.1 pin, the tree resolves to esbuild 0.25.x, which is in the vulnerable range for GHSA-gv7w-rqvm-qjhr. So the pin is now load-bearing for security, not just a cosmetic workaround.

Vite catch-up status (the original exit gate):

• vite@6.x (latest 6.4.3): still esbuild ^0.25.0 → not enough.
• vite@7.3.5: esbuild ^0.27.0 → still below 0.28.1, still vulnerable.
• vite@8.x: no longer declares a direct esbuild dependency (bundling restructured) — a major upgrade, out of scope for this cleanup.

Concrete exit criterion going forward: remove the overrides.esbuild pin only once the resolved Vite version pulls esbuild >= 0.28.1 on its own (i.e. a Vite release declaring esbuild ^0.28.0+, or a Vite 8 upgrade whose tree resolves to a patched esbuild). Until then the override and the build.target = 'es2022' knob both stay. Keeping this open as waiting.