fix: upgrade vulnerable deps to pass npm audit (CI #1276)

Bumps brace-expansion 5.0.6→5.0.7 (GHSA-3jxr-9vmj-r5cp),
undici 7.24.6→7.28.0 (multiple high CVEs), vite 8.0.5→8.1.5
(GHSA-fx2h-pf6j-xcff), and dompurify 3.4.0→3.4.12 (multiple
moderate CVEs). Adds npm overrides for brace-expansion and
updates existing undici override to ^7.28.0.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: Claude (Webhook)