chore: fix security vulnerabilities and bump dependencies

[Baoyuantop]

Summary

Resolve all open Dependabot security alerts and consolidate safe dependency upgrades into a single PR, independent of Dependabot.

Security Fixes

Package	Vulnerability	Fix
flatted (transitive via eslint → flat-cache)	Prototype pollution (CVE)	pnpm.overrides → >=3.4.2
undici (transitive via @estruyf/github-actions-reporter → @actions/http-client)	Multiple MITM/fetch vulnerabilities	pnpm.overrides → >=6.24.0

Both overrides are in package.json under pnpm.overrides. Verified via pnpm why:

• flatted resolves to 3.4.2 (was 3.4.1)
• undici resolves to 7.24.5 (was 6.23.0)

Dependency Upgrades

Pinned dependencies (explicit version bumps):

• @hookform/resolvers 5.0.1 → 5.2.2
• react-hook-form 7.56.1 → 7.72.0

Auto-ranged dependencies (via pnpm update):

• @mantine/* 8.3.16 → 8.3.18
• @tanstack/react-query 5.90.21 → 5.95.2
• @tanstack/react-router 1.166.7 → 1.168.3
• @tanstack/react-query-devtools 5.91.3 → 5.95.2
• @tanstack/react-router-devtools 1.166.7 → 1.166.11
• @tanstack/router-plugin 1.166.7 → 1.167.4
• i18next 25.8.18 → 25.10.9
• jotai 2.18.1 → 2.19.0
• dayjs 1.11.19 → 1.11.20
• nanoid 5.1.6 → 5.1.7
• typescript-eslint 8.57.0 → 8.57.2
• eslint-plugin-playwright 2.9.0 → 2.10.1
• yaml 2.8.2 → 2.8.3
• @iconify-json/material-symbols 1.2.61 → 1.2.63

GitHub Actions:

• pnpm/action-setup v4 → v5
• actions/upload-artifact v6 → v7

Skipped (major/breaking changes)

These were intentionally not upgraded to avoid breaking changes:

• eslint-plugin-react-hooks 5.x → 7.x (different config API, breaks eslint.config.ts)
• react-i18next 15.x → 16.x (major version)
• typescript 5.8.x → 5.9.x (major minor, potential type-level breakage)
• dotenv 16.x → 17.x (major version)

Verification

• ✅ pnpm build passes
• ✅ pnpm lint passes with zero warnings
• ✅ pnpm why flatted → 3.4.2
• ✅ pnpm why undici → 7.24.5