[cdbartholomew]

Routine dependency maintenance for the root package-lock.json.

Closes Dependabot alerts #2182 #2183 #2184 #2185 #2186 #2187 #2188 #2189

• follow-redirects 1.16.0 → 1.16.1 (GHSA-8r9p-f939-6h3c, GHSA-q3jh-wrc6-jgq8)
• launch-editor 2.14.1 → 2.14.2 (GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-r825-w8mm-5pxw)
• vite 8.0.16 → 8.3.4 (dev dependency; same three advisories)
• moved with vite, as it requires: rolldown 1.0.3 → 1.2.14 and its @rolldown/binding-* platform packages, @oxc-project/types 0.133.0 → 0.154.0, vite's nested lightningcss 1.32.0 → 1.33.0 and its platform packages. rolldown 1.2.14 ships an android-arm-eabi binding and no longer ships a wasm32-wasi one, so the lockfile gains one optional entry and loses two.

The lockfile was regenerated with npx npm@11 update vite launch-editor follow-redirects --package-lock-only. This is the established approach for the root lockfile: with workspaces, npm 10.9.2 can leave nested duplicate copies where npm 11 produces a single hoisted tree. Each package above has one hoisted copy after the update. The result installs cleanly with npm 10.9.2 npm ci, which is what CI runs.

braces (#1775) is not addressed: its advisory covers <= 3.0.3, and 3.0.3 is the latest release.

Verification (npm 10.9.2)

• npm ci at the root: OK
• npm run build --workspace=hindsight-clients/typescript: OK
• npm test --workspace=hindsight-all-npm: 11 passed; npm run build --workspace=hindsight-all-npm: OK
• build-control-plane steps (npm install for the workspace plus the tailwind/lightningcss packages, npm test, npm run i18n:check, npm run build): build and i18n check OK. Tests: 343 passed, 1 failed. The one failure, tests/lib/date-range-preset.test.ts › subtracts the interval 30d names, fails identically on a clean origin/main checkout. It depends on the local timezone (expected '…T13:00:00.000Z' to be '…T12:00:00.000Z').
• package.json and package-lock.json were restored after reproducing the control-plane job, so only the lockfile update itself is committed.