chore(deps): raise stale transitive dependency floors (#4629)

## Summary

A number of `pnpm.overrides` entries had drifted behind the releases
they were written against. An override fixes the resolved version
outright, so in every one of these cases the tree was pinned to the
floor value rather than picking up later releases in the same line. This
raises each floor to a current release, and widens the selectors that
were scoped to an exact upper bound so they keep matching.

| Override | Before | After |
| --- | --- | --- |
| `body-parser` (under `express@^4`) | `1.20.3` | `^1.20.6` |
| `tar` | `7.5.19` | `7.5.21` |
| `hono` | `4.12.25` | `4.12.34` |
| `undici` (6.x) | `6.27.0` | `6.28.0` |
| `undici` (7.x) | `7.28.0` | `7.29.0` |
| `js-yaml` (3.x) | `3.14.2` | `3.15.1` |
| `js-yaml` (4.x) | `4.1.1` | `4.3.1` |
| `dompurify` | `^3.4.1` | `^3.4.13` |
| `vite` | `^6.4.2` | `^6.4.3` |
| `protobufjs` | `^7.5.6` | `^7.6.5` |
| `socket.io-parser` | `^4.2.6` | `^4.2.7` |
| `postcss` | `^8.5.10` | `^8.5.23` |
| `fast-uri` | `^3.1.2` | `^3.1.5` |
| `brace-expansion` (1.x) | `1.1.13` | `1.1.18` |
| `brace-expansion` (2.x) | `2.0.3` | `2.1.4` |
| `brace-expansion` (5.x) | `5.0.6` | `5.0.9` |
| `ip-address` (under `@jsonhero/json-infer-types`) | `^10.2.0` |
`^10.3.1` |

Every parent's declared range still accepts the new resolution, so
nothing is forced outside its stated bounds by this change.

Two of these changed a default rather than just moving version.
`js-yaml` 4.2.0 stopped resolving underscore-separated scalars such as
`1_000` as numbers, which is the YAML 1.2 behaviour, and there are none
in any YAML in this repo. `brace-expansion` 2.1.x now caps expansion
size by default, well above anything a real glob produces, and
`minimatch` calls it with no options. Neither is reachable from how we
use them.

`undici@5.29.0` and `vite@4.4.9` are left alone: their parents cap below
the newer lines, so moving either would mean taking the parent across a
major.

Verified with a clean install, and `pnpm run typecheck` passes.

package.json

@@ -100,48 +100,48 @@
       "react-dom@^18": "18.3.1",
       "ai@^6": "6.0.116",
       "@ai-sdk/provider-utils@^4": "4.0.29",
-      "express@^4>body-parser": "1.20.3",
+      "express@^4>body-parser": "^1.20.6",
       "@remix-run/dev@2.17.5>tar-fs": "2.1.4",
-      "tar": "7.5.19",
+      "tar": "7.5.21",
       "form-data@^2": "2.5.4",
       "form-data@^3": "3.0.5",
       "form-data@^4": "4.0.6",
       "ws@>=7 <7.5.11": "7.5.11",
       "ws@>=8 <8.21.0": "8.21.0",
-      "hono@>=4 <4.12.25": "4.12.25",
-      "undici@>=6 <6.27.0": "6.27.0",
-      "undici@>=7 <7.28.0": "7.28.0",
-      "js-yaml@>=3.0.0 <3.14.2": "3.14.2",
-      "js-yaml@>=4.0.0 <4.1.1": "4.1.1",
+      "hono@>=4 <4.12.34": "4.12.34",
+      "undici@>=6 <6.28.0": "6.28.0",
+      "undici@>=7 <7.29.0": "7.29.0",
+      "js-yaml@>=3.0.0 <3.15.1": "3.15.1",
+      "js-yaml@>=4.0.0 <4.3.1": "4.3.1",
       "jws@<3.2.3": "3.2.3",
       "qs@>=6.0.0 <6.15.2": "^6.15.2",
       "lodash@>=4.17 <4.18.0": "^4.18.0",
       "lodash-es@>=4.17 <4.18.0": "^4.18.0",
-      "dompurify@>=3 <3.4.0": "^3.4.1",
-      "vite@>=5.0.0 <6.4.2": "^6.4.2",
+      "dompurify@>=3 <3.4.13": "^3.4.13",
+      "vite@>=5.0.0 <6.4.3": "^6.4.3",
       "rollup@>=4 <4.59.0": "^4.59.0",
       "flatted@>=3 <3.4.2": "^3.4.2",
       "picomatch@>=2 <2.3.2": "^2.3.2",
       "picomatch@>=4 <4.0.4": "^4.0.4",
       "minimatch@>=3 <3.1.3": "^3.1.3",
-      "protobufjs@>=7 <7.5.6": "^7.5.6",
+      "protobufjs@>=7 <7.6.5": "^7.6.5",
       "fast-xml-parser@>=4 <4.5.5": "^4.5.5",
       "fast-xml-parser@>=5 <5.7.0": "^5.7.0",
       "path-to-regexp@>=0.1 <0.1.13": "^0.1.13",
       "ajv@>=8 <8.18.0": "^8.18.0",
-      "socket.io-parser@>=4 <4.2.6": "^4.2.6",
-      "postcss@>=8 <8.5.10": "^8.5.10",
+      "socket.io-parser@>=4 <4.2.7": "^4.2.7",
+      "postcss@>=8 <8.5.23": "^8.5.23",
       "yaml@>=2 <2.8.3": "^2.8.3",
       "semver@>=5 <5.7.2": "^5.7.2",
       "defu@>=6 <6.1.5": "^6.1.5",
-      "fast-uri@<3.1.2": "^3.1.2",
+      "fast-uri@>=3 <3.1.5": "^3.1.5",
       "js-cookie@<3.0.8": "3.0.8",
       "tmp@<0.2.7": "0.2.7",
-      "brace-expansion@<1.1.13": "1.1.13",
-      "brace-expansion@>=2 <2.0.3": "2.0.3",
-      "brace-expansion@>=5 <5.0.6": "5.0.6",
+      "brace-expansion@<1.1.18": "1.1.18",
+      "brace-expansion@>=2 <2.1.4": "2.1.4",
+      "brace-expansion@>=5 <5.0.9": "5.0.9",
       "mermaid@>=11 <11.16.1": "^11.16.1",
-      "@jsonhero/json-infer-types>ip-address": "^10.2.0",
+      "@jsonhero/json-infer-types>ip-address": "^10.3.1",
       "@modelcontextprotocol/sdk@>=1.26.0>express-rate-limit": "^8.6.0"
     },
     "onlyBuiltDependencies": [