Investigate esbuild dev-server CORS vulnerability

[Hollujay]

Description

npm audit currently flags a moderate-severity vulnerability in esbuild
(<=0.24.2, via Vite's dependency chain): the development server allows any
website open in the browser to send requests to it and read the response.
This only affects npm run dev, not the production build.

Why this matters

This is low real-world risk for typical local development, but it's an
unaddressed known issue, and it's worth having a considered answer rather
than an unexamined one.

What "done" looks like

• Confirm whether upgrading resolves the issue without a breaking change,
  or whether the suggested fix (npm audit fix --force, which currently
  wants to bump Vite to a major version 8) is actually necessary
• If a non-breaking fix path exists, apply it
• If not, document the decision and rationale directly in this issue or in
  a code comment, rather than leaving it silently unresolved
• Confirm npm test and npm run build still pass after any change

Suggested starting points

• npm audit for the full current report
• Check Vite and esbuild's own changelogs for whether a patch release
  (not a major bump) addresses this

Complexity: Trivial-Medium

Mostly investigation and a documented decision; only becomes more involved
if a real dependency upgrade path needs testing.