fix: add pnpm overrides for vulnerable deps, move serve to devDeps, add audit CI (closes #83)

[LucasMaupin]

Summary

• Adds pnpm.overrides to pin vulnerable transitive dependencies to safe versions:
  • vite → >=6.4.3 (resolved to 8.1.5 — fixes fs.deny bypass and NTLMv2 hash disclosure)
  • postcss → >=8.5.10 (fixes CVE-2026-41305 XSS via unescaped </style>)
  • fast-uri → >=3.1.2 (fixes host confusion + path traversal)
  • brace-expansion → >=5.0.6 (fixes ReDoS)
  • js-yaml → >=4.2.0 (fixes quadratic-complexity DoS)
  • @babel/core → >=7.29.6 (fixes arbitrary file read via sourceMappingURL)
• Moves serve from dependencies → devDependencies (it is not used in Docker/production nginx deployments)
• Renames start script to start:local to make clear it is for local/dev use only; production deployments use the Docker image with nginx
• Adds .github/workflows/audit.yml running pnpm audit --audit-level=high on every PR touching package.json/pnpm-lock.yaml, and on a weekly schedule

Test plan

• Run pnpm install and verify locked versions satisfy all overrides
• Run pnpm audit and confirm high-severity advisories are resolved
• Verify pnpm build succeeds
• Confirm serve is no longer in the production dependency set (pnpm list --prod | grep serve returns empty)
• Verify the audit CI workflow triggers on a test PR changing package.json

Closes #83

🤖 Generated with Claude Code