chore: fix npm audit vulnerabilities

[numbers-official]

Summary

This PR fixes the current npm audit vulnerabilities reported on main.

The change is intentionally limited to package-lock.json: it refreshes vulnerable transitive dependencies resolved through the existing dependency ranges. No direct dependency ranges in package.json are changed.

Vulnerabilities Resolved

npm audit previously reported 5 vulnerabilities:

• vite — high severity advisory chain from vite <=6.4.1
• postcss — moderate severity
• picomatch — high / moderate advisories across transitive copies
• brace-expansion — moderate severity across transitive copies
• flatted — high severity

After this PR:

npm audit --audit-level=moderate
# found 0 vulnerabilities

Dependency Scope

• package.json: unchanged
• package-lock.json: updated only through non-forced npm audit fix
• No npm audit fix --force
• No runtime code changes

The lockfile update moves vulnerable transitive packages to patched versions, including vite@6.4.2, postcss@8.5.14, patched picomatch, brace-expansion, and flatted versions.

Verification

• npm ci
• npm audit --audit-level=moderate -> 0 vulnerabilities
• npm run lint
• npx tsc --noEmit
• OAUTH_CLIENT_ID=test-client-id EXTENSION_KEY=test-extension-key npm run generate-manifest && npm run build
• GitHub CI passes