chore: merge main into dependency-cooldown branch and fix audit vulnerabilities

[Copilot]

PR #92 had merge conflicts with main (which had advanced through PRs #93–#96) and two new audit vulnerabilities surfaced after the merge.

Conflict resolution

• bunfig.toml: kept minimumReleaseAgeExcludes from main alongside the existing minimumReleaseAge = 604800
• package.json / bun.lock: merged vite override from main with smol-toml and picomatch overrides from the PR branch

Audit fixes

Two vulnerabilities exposed after the merge:

• fast-xml-parser — bumped override floor from >=5.5.7 → >=5.7.0 (GHSA-gh4j-gqv2-49f6)
• postcss — added override >=8.5.10 (GHSA-qx2v-qp2m-jg93)

"overrides": {
  "fast-xml-parser": ">=5.7.0",
  "rollup": ">=4.59.0",
  "smol-toml": ">=1.6.1",
  "vite": ">=7.3.2 <8.0.0",
  "picomatch": ">=4.0.4",
  "postcss": ">=8.5.10"
}