fix(deps): patch 17 of 18 known CVEs in dependencies

The CI run on commit 656d2eb (the previous SECRETS_RUNBOOK deletion)
failed at the `npm audit --audit-level=critical` gate because
npm's vulnerability database disclosed CVEs against several deps
between when v2.0.7 was published (2026-04-09) and now. None of
these are exploitable in this app's actual usage; they're flagged
because the dep tree's pinned versions are now in the
known-vulnerable range.

Two operations:

1. `npm audit fix` (no --force, lockfile-only changes):
   Bumped 13 dev/build deps within their existing semver ranges to
   patched versions. Reduced 18 -> 5 vulnerabilities. The fixed deps
   include vite, rollup, tar, underscore (transitives), and several
   PostCSS/typescript-eslint packages. Zero changes to package.json -
   only patch versions changed.

2. Added an `overrides` block forcing protobufjs to ^7.5.5:
   The remaining 4 critical vulns were all transitive via the
   abandoned package chain
   @xenova/transformers (latest = 2.17.2; HuggingFace deprecated this
   line in favour of @huggingface/transformers)
     -> onnxruntime-web -> onnx-proto -> protobufjs <7.5.5
   protobufjs 6.x has the GHSA-xq3m-2v4x-88gg arbitrary code
   execution CVE; the v6 line was patched in 6.11.4 but npm's audit
   database treats all <7.5.5 as vulnerable. `npm overrides` forces
   the lockfile to use protobufjs ^7.5.5 across the whole tree
   regardless of what onnx-proto declares. The protobufjs 6 -> 7
   change is mostly internal API tweaks; runtime parsing of bundled
   ONNX model descriptors is unaffected. Verified locally: 527/527
   tests pass, tsc --noEmit clean. Reduced 5 -> 1.

Result:
  - critical: 4 -> 0
  - high:     10 -> 0
  - moderate: 4 -> 1 (uuid <14 transitive bound-check; root
    project already uses uuid v13, this is dev-tooling only)
  - total:    18 -> 1

CI gate (--audit-level=critical) passes.

Note: the protobufjs CVE describes attacker-controlled protobuf
descriptors triggering code execution. This codebase uses
@xenova/transformers ONLY to load app-bundled ONNX embedding models,
not user-supplied protobufs. Real-world exploitability against this
specific app was never present, but the dep-level fix removes the
audit warning and aligns the lockfile with current advisory status.

Long-term, @xenova/transformers should migrate to
@huggingface/transformers (the maintained successor). That migration
is a larger code change; out of scope for this audit-fix commit.

Author: Chaitanya Laxman