Fix security alerts: bump vite to 6.4.2, override lodash to 4.18.1

- Vite 6.4.1 → 6.4.2: fixes path traversal in optimized deps .map
  handling (medium) and arbitrary file read via dev server WebSocket
  (high)
- lodash 4.17.23 → 4.18.1 via pnpm override: fixes code injection
  via _.template (CVE-2026-4800, high) and prototype pollution via
  _.unset/_.omit (CVE-2026-2950, medium). Transitive dep from
  @react-router/dev — override needed until they bump it upstream.
  Skipped 4.18.0 which was marked as a bad release.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

package.json

@@ -26,7 +26,8 @@
     "overrides": {
       "picomatch@>=4.0.0 <4.0.4": "4.0.4",
       "brace-expansion@>=4.0.0 <5.0.5": "5.0.5",
-      "path-to-regexp@<0.1.13": "0.1.13"
+      "path-to-regexp@<0.1.13": "0.1.13",
+      "lodash@<4.18.1": "4.18.1"
     },
     "onlyBuiltDependencies": [
       "@sentry/cli",