chore(deps): patch Dependabot security alerts

Bump vite, hono, react-router, and exifreader within their existing
ranges, and update pnpm overrides for undici, qs, esbuild, plus new
overrides for protobufjs and ws. undici and protobufjs are capped to
their current major to avoid breaking transitive consumers.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: bchapuis

package.json

@@ -32,11 +32,14 @@
     },
     "overrides": {
       "esbuild@<=0.24.2": ">=0.25.0",
-      "undici@>=7.0.0 <7.18.2": ">=7.18.2",
+      "esbuild@>=0.27.3 <0.28.1": ">=0.28.1",
+      "undici@>=7.0.0 <7.28.0": ">=7.28.0 <8",
       "minimatch@<10.2.3": ">=10.2.3",
       "axios@>=1.0.0 <=1.13.4": ">=1.13.5",
-      "qs@>=6.7.0 <=6.14.1": ">=6.14.2",
-      "lodash@>=4.0.0 <=4.17.22": ">=4.17.23"
+      "qs@>=6.7.0 <6.15.2": ">=6.15.2",
+      "lodash@>=4.0.0 <=4.17.22": ">=4.17.23",
+      "protobufjs@<=7.6.2": ">=7.6.3 <8",
+      "ws@>=8.0.0 <8.20.1": ">=8.20.1"
     }
   }
 }