fix(deps): Update overrides for brace-expansion, postcss, and tar to resolve security vulnerabilities

Bump npm overrides to fix Security workflow failure (run #182):
- brace-expansion >=5.0.8: DoS via exponential-time expansion (GHSA-3jxr-9vmj-r5cp)
  and OOM crash from unbounded expansion (GHSA-mh99-v99m-4gvg)
- postcss >=8.5.18: path traversal via sourceMappingURL auto-loading (GHSA-r28c-9q8g-f849)
- tar >=7.5.21: multiple critical issues including PAX numeric path confusion (GHSA-w8wr-v893-vjvp),
  decompression DoS (GHSA-23hp-3jrh-7fpw), negative size infinite loop (GHSA-8x88-c5mf-7j5w),
  NUL byte exception DoS (GHSA-gvwx-54wh-qm9j), and stack-overflow DoS (GHSA-r292-9mhp-454m)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: Claude (Webhook)

package-lock.json

@@ -84,10 +84,10 @@
     "vitest": "^4.1.4"
   },
   "overrides": {
-    "postcss": ">=8.5.10",
-    "brace-expansion": ">=5.0.6",
+    "postcss": ">=8.5.18",
+    "brace-expansion": ">=5.0.8",
     "esbuild": ">=0.28.1",
-    "tar": ">=7.5.16",
+    "tar": ">=7.5.21",
     "vite": ">=8.0.16"
   }
 }