build(deps): safe-subset updates + esbuild security fix (pin breaking majors) (#33)

Replaces the failing all-dependencies group PR #32 (64 updates).

SECURITY (clears GHSA-gv7w-rqvm-qjhr, esbuild high-severity / npm audit):
  - vite 7 -> 8  (vite 8 drops esbuild in favour of rolldown)
  - @vitejs/plugin-react-swc 3 -> 4  (required peer for vite 8)
  - overrides.esbuild = 0.28.1  (patches lovable-tagger's transitive
    esbuild ^0.25, the only remaining esbuild consumer; lovable-tagger
    is a dev-only component tagger)
  Result: npm audit --audit-level=high -> 0 vulnerabilities.

APPLIED (36 non-breaking, same-major): the full @radix-ui/* family,
  @supabase/supabase-js, @tanstack/react-query, cmdk, embla-carousel-react,
  input-otp, next-themes, autoprefixer, typescript-eslint,
  @tailwindcss/typography, eslint-plugin-react-refresh.

PINNED / deferred (breaking majors from #32):
  react/react-dom 18 (not 19), @types/react(/-dom) 18, tailwindcss 3
  (not 4), zod 3 (not 4), typescript 5.5 (not 6), react-router-dom 6
  (not 7), recharts 2 (not 3), react-day-picker 8, react-resizable-panels
  2, @hookform/resolvers 3, date-fns 3, lucide-react 0.462, sonner 1,
  vaul 0.9, tailwind-merge 2, eslint 9, @eslint/js 9,
  eslint-plugin-react-hooks 5, globals 15, @types/node 22,
  @vercel/analytics 1.

Verified locally (node 22): npm audit clean, tsc typecheck OK,
vite build OK, vitest 9/9 pass, dev server + preview both serve / -> 200.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: andreibesleaga