fix(security): patch picomatch ReDoS/method injection

[birme]

Summary

• Patched picomatch transitive vulnerabilities (GHSA-c2c7-rcm5-vvqj ReDoS, GHSA-3v7f-55p6-f55p method injection). Vulnerable range: <=2.3.1 || 4.0.0 - 4.0.3.
• Two majors were in use; both bumped within their own major (no breaking major forced):
  • v2 tree (lint-staged -> micromatch): 2.3.1 -> 2.3.2
  • v4 trees (vite, vitest, vite-plugin-svgr, tinyglobby, fdir): 4.0.3 -> 4.0.7
• Method: npm audit fix only — lockfile-only change, no overrides needed. It also patch-bumped vite 7.3.1 -> 7.3.6.

Test plan

• Tests pass (npm test) — 147 tests across 18 files
• TypeScript compiles (npm run typecheck)
• Lint clean (npm run lint)
• npm ls picomatch shows only safe versions (2.3.2 / 4.0.7)

Closes #641

🤖 Generated with Claude Code

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com