fix(deps): resolve the open critical and high dependency alerts (#184)

Bump vitest to 4.1.11 across every workspace (drops the vulnerable
tinypool and @vitest/mocker it bundled), postcss to 8.5.23 (pulls
patched nanoid and source-map-js) and react-router-dom to 7.18.2
(pulls patched react-router) as direct dependency bumps.

Add npm overrides for the alerts with no direct dependency to bump:
js-yaml (via eslint's eslintrc), browserslist (via autoprefixer,
also clears the baseline-browser-mapping alert), postcss-selector-parser
(via tailwindcss) and brace-expansion, scoped separately for its two
unrelated lineages (eslint-plugin-jsx-a11y's minimatch@3 and
typescript-eslint's minimatch@10) so each keeps its own major version.

braces has no patched release yet (tracked separately); it only
reaches tailwindcss's dev-time file watcher and content globbing, so
it never processes anything but our own trusted config and never
ships in the built bundle.

Signed-off-by: Bugs5382 <12115015+Bugs5382@users.noreply.github.com>
Co-authored-by: Bugs5382 <12115015+Bugs5382@users.noreply.github.com>

Author: Bugs5382

apps/console/package.json

@@ -26,7 +26,7 @@
     "lucide-react": "^0.469.0",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
-    "react-router-dom": "^7.1.1",
+    "react-router-dom": "^7.18.2",
     "reflect-metadata": "^0.2.2",
     "tailwind-merge": "^2.6.0",
     "tailwindcss-animate": "^1.0.7"
@@ -41,11 +41,11 @@
     "@vitejs/plugin-react": "^4.3.4",
     "autoprefixer": "^10.4.20",
     "jsdom": "^25.0.1",
-    "postcss": "^8.4.49",
+    "postcss": "^8.5.23",
     "tailwindcss": "^3.4.17",
     "typescript": "^5.7.2",
     "vite": "^6.0.7",
-    "vitest": "^3.0.0",
+    "vitest": "^4.1.11",
     "vitest-axe": "^0.1.0"
   }
 }