chore(security): resolve pnpm audit vulnerabilities (2 high, 2 moderate) - #405

Summary

Fixes the 4 vulnerabilities reported by pnpm audit (the failing Audit - All / Audit - Production CI jobs). All are transitive dev dependencies, addressed via the repo's existing conventions — pnpm.overrides floors for transitive deps, and a direct-dep range bump where the vuln is pinned by its parent.

Approach

• vite → bumped the existing override floor >=7.3.2 → >=8.0.16.
• js-yaml → new override floor >=4.2.0 (satisfies json-schema-to-typescript's ^4.1.0).
• esbuild → bumped tsx ^4.20.6 → ^4.22.4 in packages/{cli,convert,mcp}. esbuild is pinned by tsx, so bumping tsx is cleaner and safer than forcing an esbuild override (which would fight tsx's pin and disturb vite/vitest's shared esbuild).

Note: vite is an auto-installed peer, which pnpm won't move above its locked version via an override alone. The lockfile bump to 8.0.16 was forced once; the >=8.0.16 floor holds it (and a from-scratch resolve picks it, being the latest satisfying the floor).

Lockfile changes are contained to these four bumps plus their direct consequences (re-keyed vitest/vite-tsconfig-paths; minor transitive shifts in nanoid/postcss/rolldown/tinyglobby).

Verification

• ✅ pnpm audit and pnpm audit --prod → no known vulnerabilities
• ✅ pnpm install --frozen-lockfile → lock ↔ package.json consistent
• ✅ pnpm build, pnpm typecheck
• ✅ pnpm test → 2248 passed

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated dependency versions: js-yaml (>=4.2.0), vite (>=8.0.16), and tsx (^4.22.4)