deps: bump esbuild 0.24.2 → 0.25.12 (closes dependabot #60)

Patches GHSA-67mh-4wv8-2f99 — esbuild dev server allowed any website to send
arbitrary requests and read responses. Affects local dev only (not the built
production bundle), but no reason not to fix.

Build verified: `npm run build` green, dist/* output identical shape.

Author: frstrtr