chore(deps): bump vite to ^7.3.2 to close 3 advisories

Resolves 3 advisories surfaced by `npm audit --omit=dev`:

- vite (high) — path traversal in optimized-deps `.map`
  (GHSA-4w7w-66w2-5vf9), `server.fs.deny` bypass via queries
  (GHSA-v2wj-q39q-566r), arbitrary file read via dev-server WS
  (GHSA-p9ff-h696-f583).
- picomatch 4.0.3 → 4.0.4 (transitive via vite/fdir/tinyglobby) —
  POSIX class method injection (GHSA-3v7f-55p6-f55p) + extglob ReDoS
  (GHSA-c2c7-rcm5-vvqj).
- postcss 8.5.6 → 8.5.12 (transitive via vite) — `</style>` XSS in
  CSS stringify output (GHSA-qx2v-qp2m-jg93).

Verified: `npm audit --omit=dev` reports 0 vulnerabilities;
`npm run test` passes (29 files, 503 tests).

E2E suite (`test:e2e`) was reproduced both pre-bump and post-bump
with identical "Timed out waiting for step 1" failures across all
PDF/Image specs — pre-existing, not introduced here. Tracked
separately.

All affected packages are dev/build tooling that doesn't ship in
the Tauri binary; the patches still matter for any contributor
running `npm run dev` because vite's dev server is exposed.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: shyhunter

package-lock.json

@@ -62,7 +62,7 @@
     "shadcn": "^3.8.5",
     "tw-animate-css": "^1.4.0",
     "typescript": "~5.8.3",
-    "vite": "^7.0.4",
+    "vite": "^7.3.2",
     "vitest": "^4.0.18",
     "webdriverio": "^9.24.0"
   }