chore(deps): batch dep bumps (tailwindcss 4.3.1, lucide-react 1.18.0, workers-types)

[nocoo]

Summary

Batch dependency upgrades from the 2026-06-13 autopilot scan. Five of six issues handled; one major bump deferred (see below).

Package	Old	New	Issue
esbuild (worker override)	0.27.3 (via wrangler)	0.28.1	Closes #82
tailwindcss	4.3.0	4.3.1	Closes #85
@tailwindcss/postcss	4.3.0	4.3.1	Closes #81
lucide-react	1.17.0	1.18.0	Closes #84
@cloudflare/workers-types (worker)	4.20260611.1	4.20260612.1 (manifest) / 4.20260613.1 (resolved)	Closes #80

esbuild fix (#82)

Root package.json already pinned esbuild: ^0.28.1 directly and via overrides, but root overrides don't cross workspace boundaries. wrangler@4.100.0 (worker devDep) pins esbuild@0.27.3, so worker/bun.lock still resolved to the vulnerable version. Fix: add "esbuild": "^0.28.1" to worker/package.json's overrides. After reinstall, cd worker && bun pm why esbuild reports esbuild@0.28.1.

Deferred: eslint 9.39.4 → 10.5.0 (#83)

ESLint 10 is incompatible with eslint-plugin-react@7.37.5 (latest), which is pulled transitively via eslint-config-next@16.2.9. Attempting to lint with eslint@10 throws:

TypeError: Error while loading rule 'react/display-name':
  contextOrFilename.getFilename is not a function
    at .../eslint-plugin-react/lib/util/version.js:31:100

eslint-plugin-react's peerDep is "^3 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9.7" — eslint 10 not accepted. Revisit when upstream ships eslint 10 support. Issue #83 left open.

Test plan

• bun install --frozen-lockfile (root + worker)
• bun run lint — 0 warnings, 0 errors
• bun run typecheck — clean
• bun run worker:typecheck — clean
• bun run test — 957 passed (71 files)
• bun run test:worker — 247 passed (16 files)
• cd worker && bun pm why esbuild → esbuild@0.28.1