fix(security): patch vulnerable transitive deps via pnpm overrides

- minimatch 3.1.2→3.1.5, 9.0.5→9.0.9 (ReDoS CVE-2026-26996, CVE-2026-27904)
- semver 7.7.2→7.8.5 (ReDoS CVE-2026-3672)
- flatted 3.3.3→3.4.3 (DoS CVE-2026-32141)
- ajv 6.12.6→6.15.0 (ReDoS CVE-2025-69873)

All affected packages are devDependencies (eslint, vitest, wrangler toolchain)
and do not ship to the production client bundle.

Author: ayoub3bidi

package.json

@@ -109,7 +109,12 @@
   },
   "pnpm": {
     "overrides": {
-      "vite": "npm:rolldown-vite@7.2.10"
+      "vite": "npm:rolldown-vite@7.2.10",
+      "minimatch@3": "3.1.5",
+      "minimatch@9": "9.0.9",
+      "semver@7": "7.8.5",
+      "flatted": "3.4.3",
+      "ajv@6": "6.15.0"
     }
   }
 }