chore(deps): bump vite to 6.4.2 and picomatch to 4.0.4 in /web (#1098)

Security patches for two advisories blocked on Dependabot:

- vite 6.4.1 → 6.4.2: path traversal in optimize deps sourcemap handler,
  server.fs check for env transport (vitejs/vite#22161, #22159)
- picomatch 4.0.3 → 4.0.4: CVE-2026-33671, CVE-2026-33672

Replaces #1088 and #1058, which were stuck on CI because Dependabot's
lockfile regeneration produced a divergent lockfile vs. dev (dropped
@trpc/server and react-is resolved entries, added platform-specific
tailwindcss-oxide-wasm32-wasi nested entries). Rather than iterate on
@dependabot recreate, bundled both bumps into a single manual PR with
a lockfile regenerated from dev's current state.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: zbigniewsobiecki

web/package-lock.json

@@ -37,6 +37,6 @@
 		"@vitejs/plugin-react": "^4.5.2",
 		"tailwindcss": "^4.1.7",
 		"typescript": "^5.7.2",
-		"vite": "^6.3.5"
+		"vite": "^6.4.2"
 	}
 }