Update Go toolchain to 1.27.1 and refresh all dependencies

[ellgreen]

Summary

• Bumps the Go toolchain directive to go 1.27.1 and updates every Go module dependency to its latest version.
• Updates all UI (pnpm) dependencies within their existing semver ranges.
• Adds a scoped pnpm.overrides entry (tsx>esbuild) to patch a ReDoS vulnerability in the one remaining nested esbuild copy, without touching Vite's own bundler esbuild (a blanket override broke production minification for the configured legacy browser targets).

Security

• govulncheck ./...: 0 reachable vulnerabilities in the Go module. One advisory remains for golang.org/x/crypto/openpgp (unmaintained, no fix available) but it's an unused transitive dependency the code never calls.
• pnpm audit: 115 → 0 vulnerabilities, including a critical seroval deserialization bug (via @tanstack/react-router) and a stack of high-severity axios CVEs (SSRF, prototype pollution, header injection) — all resolved by the in-range dependency bumps plus the esbuild override.

Test plan

• go build ./... && go vet ./... && go test ./...
• go build -tags bundled -o ./build/ ./cmd/... (full production build with embedded UI)
• cd ui && pnpm lint && pnpm exec tsc -b && pnpm test && pnpm build
• govulncheck ./...
• pnpm audit

Notes for reviewers

• Left several UI packages at their current major version (TypeScript, Vite, Vitest, ESLint, Zod, etc.) since newer majors are available but not security-driven, and carry real breaking-change migrations — happy to follow up separately if wanted.
• The packageManager pin in ui/package.json is unchanged; this dev sandbox's corepack couldn't load pnpm 12's new native-binary distribution, so I didn't force that bump.

🤖 Generated with Claude Code