Non-blocking review findings from PR #151 (1)

[twistedmelonman]

Non-blocking concerns raised while reviewing PR #151 (fix(deps): clear all 10 advisories via @netlify/vite-plugin override).

None of these blocked the merge. They are batched into one issue so a
review's findings stay one unit of attention rather than 1 separate
tracking issues; tick items off as they are addressed, and close this issue
when the list is done or the remaining items are judged not worth doing.

• The @netlify/vite-plugin override is load-bearing and should be dropped once vite-plugin's @netlify/dev ^4 range pins consumers to unpatched image-size advisories netlify/framework-adapters#47 lands (PR author documentation in docs/SECURITY-AUDIT.md, corroborated by the claude blocking review, package.json (overrides), docs/SECURITY-AUDIT.md)
  The PR's own documentation states that netlify/framework-adapters#47 is the real fix, and that once vite-plugin's range is widened in @astrojs/netlify, this override becomes unnecessary. It further notes the override is currently load-bearing — removing it would silently restore all 10 advisories. The .github/dependabot.yml comment adds that Dependabot does not manage overrides, so nothing automated will revisit this entry. Worth tracking so the override is revisited when the upstream fix ships rather than accumulating as a permanent unexplained pin.