Resolve Dependabot dependency alerts

[dantraynor]

Summary

• Add pnpm overrides for the vulnerable transitive npm tooling dependencies: vite, postcss, ws, tmp, fast-uri, defu, and brace-expansion 5.x.
• Regenerate the pnpm lockfile so the patched versions are used deterministically.
• Bump the Go host's indirect filippo.io/edwards25519 dependency from v1.1.0 to v1.1.1.

This addresses Dependabot alerts #1, #2, #3, #4, #5, #7, #8, #9, #10, #12, and #13. Alert #11 remains a dev-only uuid transitive dependency through node-notifier/web-ext and is handled separately as accepted risk.

Validation

• pnpm install
• pnpm typecheck
• pnpm test
• pnpm build:chrome
• pnpm review:firefox
• cd host && go build ./...