chore(deps): patch postcss and esbuild advisories

Resolves the two open Dependabot alerts, both dev-only transitives:

- postcss 8.5.15 -> 8.5.25 (GHSA-r28c-9q8g-f849, high): sourceMappingURL
  path traversal. Reached via vite; a lockfile refresh is enough since
  vite wants ^8.5.15 and tsup peers ^8.4.12.
- esbuild 0.27.7 -> 0.28.1 (GHSA-g7r4-m6w7-qqqr, low): dev-server
  arbitrary file read on Windows. tsup pins ^0.27.0, so this needs an
  overrides entry to pull the patched minor.

npm audit reports 0 vulnerabilities. npm run prepublishOnly passes:
typecheck, 393 tests, ESM and DTS build.

Author: justin-carper