fix(deps): remediate remaining vulnerability findings

[ryok90]

Summary

• update Vite to 8.2.2, resolving PostCSS to 8.5.28
• pin esbuild 0.28.1 as Vite's required optional peer in each example
• override vulnerable Browserslist versions to 4.28.7
• update serde_with and serde_with_macros to 3.21.0
• apply the rustfmt output required by the current toolchain

Resolved findings

• GHSA-g7r4-m6w7-qqqr: esbuild 0.27.3 -> 0.28.1
• CVE-2026-73088 and CVE-2026-73089: browserslist 4.28.4 -> 4.28.7
• CVE-2026-69153: postcss 8.5.19 -> 8.5.28
• GHSA-7gcf-g7xr-8hxj: serde_with 3.19.0 -> 3.21.0

Residual upstream constraint

GHSA-wrw7-89jp-8q8g remains for glib 0.18.5. The Linux dependency graph is tied to gtk 0.18 through Tauri/Wry/WebKitGTK. There is no gtk 0.20 release that can accept glib 0.20, so forcing glib independently would split incompatible GTK types. This requires an upstream Tauri/Wry GTK-stack migration.

Verification

• pnpm install --frozen-lockfile
• pnpm audit --audit-level low (no known JavaScript vulnerabilities)
• pnpm -r run build
• cargo fmt --all -- --check
• cargo check --workspace --all-targets --all-features
• cargo clippy --all-features
• cargo test --all-features
• cargo build --all-features
• git diff --check