fix(deps): patch use-case library build dependencies (CVE-521)

[thedumsieffect]

Summary

• Upgrade Vite from 5.4.21 to 6.4.3, closing the manifest and lockfile alerts tracked by CVE-521 and CVE-523
• Refresh transitive brace-expansion 2.x and 5.x paths to patched releases for CVE-522
• Pull esbuild to 0.25.12 through Vite 6, also resolving the later CVE-526 ticket

Test plan

• Install with pnpm install --frozen-lockfile
• Run node --test scripts/validate-runneth-package-index.mjs
• Build the frontend and server with pnpm build
• Inspect the recursive dependency graph for Vite, esbuild, and both brace-expansion lines

Staging smoke

• Deploy this PR by itself before the stacked rate-limit PR
• Load the rebuilding page and verify JavaScript, CSS, and favicon assets return without errors
• Hard-refresh a frontend route and verify the SPA fallback still loads
• Verify GET /api/health returns successfully

Notes

• The production JavaScript bundle changes from 266.20 kB / 84.54 kB gzip to 267.67 kB / 85.36 kB gzip (+0.6% raw)

Linear

CVE-521
CVE-522
CVE-523
CVE-526