chore(deps): bump esbuild 0.28.0 -> 0.28.1 (GHSA-g7r4-m6w7-qqqr)

[felixgeelhaar]

Clears the residual low-severity dependency advisory in internal/ui/web.

Change

Package	From	To	Advisory	Severity
esbuild	0.28.0	0.28.1	GHSA-g7r4-m6w7-qqqr	low

esbuild turned out to be a direct devDependency of internal/ui/web, not transitive — so this is a straight patch bump of the declared range to ^0.28.1. No npm overrides entry was needed; all 27 @esbuild/* platform packages moved to 0.28.1 in the lockfile alongside it.

Verification

• nox scan — the esbuild advisory is gone; 0 active critical/high findings (no regression).
• npm run build passes (../assets/app.js rebuilt, byte-identical).
• npm run typecheck (tsc --noEmit) passes clean.

Notes

• This remediation is non-gating: the CI security gate fails only on net-new critical/high, and this was a low. Nothing was baselined or waived.
• The remaining active dependency findings are the Go golang.org/x/text and cel-go bumps, already covered by the open PR on chore/residual-dep-cves. This branch is deliberately separate so the two don't collide.
• Only internal/ui/web/package.json and internal/ui/web/package-lock.json are touched.

https://claude.ai/code/session_01Cr6YdzphmFF3NJqm7kSJom