Bump transitive esbuild to 0.28.1 (Dependabot alert 31)

Updates vite 7.3.5 -> 7.3.6 in the lockfile so esbuild resolves to
0.28.1, fixing GHSA-g7r4-m6w7-qqqr (arbitrary file read via the esbuild
dev server on Windows; low severity, dev-only tooling via vitest).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: Lingz450