chore(deps): fix Dependabot security alerts (#101)

* chore(deps): fix Dependabot security alerts

Resolves 6 open advisories:

- vite ^5.0.0 → ^6.4.2 — fixes GHSA-4w7w-66w2-5vf9 path traversal
  in optimized deps .map handling (alerts #234, #235).
- postcss override <8.5.10 → ^8.5.10 — fixes GHSA-qx2v-qp2m-jg93
  XSS via unescaped </style> (alert #262). Pulled in transitively
  by vite.
- uuid override <11.1.1 → ^11.1.1 — fixes GHSA-w5hq-g745-h8pq
  missing buffer bounds check (alert #246). Transitive via
  @muyajs/core → mermaid.
- lodash-es override <4.18.0 → ^4.18.0 — fixes GHSA-r5fr-rjxr-66jc
  (_.template code injection) and GHSA-f23m-r3pf-42rh
  (_.unset/_.omit prototype pollution); alerts #230, #231.
  Transitive via @muyajs/core → mermaid → dagre-d3-es.

Vite stays on v6 because CI (.github/workflows/deploy.yml) pins
Node 18, and vite 7+ requires Node 20.19+.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(lint): restore eslint config for React + TS

The Vue-era .eslintrc.js was deleted in a33f339 (vue-to-react
refactor) but the `lint` script in package.json still references
eslint, so `pnpm lint` errored with "couldn't find a configuration
file" on every run.

Add a standard Vite-React-TS .eslintrc.cjs aligned with the
already-installed plugins (@typescript-eslint, react,
react-hooks, react-refresh). Escape two apostrophes in Sponsor.tsx
that the new react/no-unescaped-entities rule flagged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Jocs

.eslintrc.cjs

@@ -0,0 +1,28 @@
+module.exports = {
+  root: true,
+  env: { browser: true, es2020: true, node: true },
+  extends: [
+    'eslint:recommended',
+    'plugin:@typescript-eslint/recommended',
+    'plugin:react/recommended',
+    'plugin:react/jsx-runtime',
+    'plugin:react-hooks/recommended',
+  ],
+  ignorePatterns: ['build', 'node_modules', '.eslintrc.cjs'],
+  parser: '@typescript-eslint/parser',
+  parserOptions: {
+    ecmaVersion: 'latest',
+    sourceType: 'module',
+    ecmaFeatures: { jsx: true },
+  },
+  settings: {
+    react: { version: 'detect' },
+  },
+  plugins: ['react-refresh'],
+  rules: {
+    'react-refresh/only-export-components': [
+      'warn',
+      { allowConstantExport: true },
+    ],
+  },
+}

package.json

@@ -28,7 +28,14 @@
     "eslint-plugin-react-hooks": "^4.6.0",
     "eslint-plugin-react-refresh": "^0.4.4",
     "typescript": "^5.2.2",
-    "vite": "^5.0.0",
+    "vite": "^6.4.2",
     "vite-plugin-svgr": "^4.2.0"
+  },
+  "pnpm": {
+    "overrides": {
+      "postcss@<8.5.10": "^8.5.10",
+      "uuid@<11.1.1": "^11.1.1",
+      "lodash-es@<4.18.0": "^4.18.0"
+    }
   }
 }