fix: override esbuild to >=0.28.1 to resolve security advisories

[stefanowitschdev]

Summary

Closes the esbuild security advisories flagged by pnpm audit. The vulnerable esbuild@0.18.20 was pulled in only through the dev toolchain (drizzle-kit → @esbuild-kit/esm-loader → @esbuild-kit/core-utils → esbuild), so this affects local development only — not the production/Docker build.

Inspired by upstream PR leonvanzyl/agentic-coding-starter-kit#1, but raised the floor further to also clear newer advisories.

Changes

• Add esbuild: ">=0.28.1" override.
• Move all overrides to pnpm-workspace.yaml — pnpm v11 no longer reads the pnpm.overrides field in package.json, so the existing @types/react / @types/react-dom overrides were being silently ignored. They now actually take effect (resolved versions are unchanged: 19.2.5 / 19.2.3).
• Regenerate pnpm-lock.yaml.

Advisories resolved

Advisory	Severity	Range
GHSA-67mh-4wv8-2f99 (dev-server)	moderate	<=0.24.2
GHSA-g7r4-m6w7-qqqr (arbitrary file read)	low	>=0.27.3 <0.28.1
GHSA-36qx-fr4f-26g5 (binary integrity)	high	>=0.17.0 <0.28.1

After the change only a single esbuild@0.28.1 remains and pnpm audit reports no esbuild advisories.

Verification

• pnpm audit — no esbuild advisories remain (high 10→9, low 5→4)
• pnpm exec tsx — TypeScript transpiles/runs via esbuild 0.28.1
• pnpm exec drizzle-kit check — config loads, "Everything's fine"
• pnpm lint — clean
• pnpm build — compiles + TypeScript pass (full build verified with env vars set)

🤖 Generated with Claude Code