[codex] patch Vite security advisory

[Vedasheersh]

Summary

• bump frontend vite from ^6.3.5 to ^6.4.2
• refresh the frontend lockfile to install patched vite 6.4.2
• pick up lockfile-only fixes for picomatch and brace-expansion

Why

GitHub flagged catpred/web/frontend/package-lock.json for CVE-2026-39363 / GHSA-p9ff-h696-f583, which affects Vite 6.0.0 through 6.4.1. This branch moves the frontend to the first patched 6.x release and clears the remaining frontend audit findings in the lockfile.

Impact

• resolves the Vite Dependabot alert for the frontend dependency tree
• keeps the change limited to frontend dependency metadata and lockfile updates
• avoids pulling unrelated work from the current local feature branch

Validation

• npm audit
• npm run build