chore(deps): bump vite to ^7.3.5 (CVE fixes) (#1709)

Bumps the client's vite dev dependency from ^7.1.11 to ^7.3.5 to
resolve Dependabot security alerts.

- #123 (HIGH): vite server.fs.deny bypass, patched in 7.3.5
- #129 (MEDIUM): vulnerability in launch-editor, a transitive dep of
  vite; the newer vite no longer pulls in launch-editor, clearing it


Claude-Session: https://claude.ai/code/session_01HiccCEh9mwCfVzE8qYcop1

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

client/package.json

@@ -85,6 +85,6 @@
     "ts-jest": "^29.4.0",
     "typescript": "^5.5.3",
     "typescript-eslint": "^8.38.0",
-    "vite": "^7.1.11"
+    "vite": "^7.3.5"
   }
 }

package-lock.json

@@ -136,7 +136,7 @@
         "ts-jest": "^29.4.0",
         "typescript": "^5.5.3",
         "typescript-eslint": "^8.38.0",
-        "vite": "^7.1.11"
+        "vite": "^7.3.5"
       }
     },
     "client/node_modules/jest-environment-jsdom": {
@@ -12959,13 +12959,13 @@
       }
     },
     "node_modules/vite": {
-      "version": "7.3.3",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-7.3.3.tgz",
-      "integrity": "sha512-/4XH147Ui7OGTjg3HbdWe5arnZQSbfuRzdr9Ec7TQi5I7R+ir0Rlc9GIvD4v0XZurELqA035KVXJXpR61xhiTA==",
+      "version": "7.3.6",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-7.3.6.tgz",
+      "integrity": "sha512-4XP60spRGjSZFf1qYH+dJIkK2znL3zQfl9KkOV9MkkRR/3Dls0dxaBsQPTloEc5BLXWPL9vsOxopxyKoMmDueg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "esbuild": "^0.27.0",
+        "esbuild": "^0.27.0 || ^0.28.0",
         "fdir": "^6.5.0",
         "picomatch": "^4.0.3",
         "postcss": "^8.5.6",