fix(deps): override braces, source-map-js and postcss-selector-parser

Three runtime advisories:
- braces <= 3.0.3 (GHSA-vfj7-8cjw-p6xm, no upstream fix) → `npm:@pezkuwi/braces@^3.0.4`, our patched fork (as in pezkuwi-api);
- source-map-js < 1.2.2 (GHSA-68fv-2mgg-jv7q) → ^1.2.2 (was 1.2.1);
- postcss-selector-parser < 7.1.6 (GHSA-rj75-hqrm-r3gf) → ^7.1.6. It was 6.0.10/6.1.2 under tailwindcss and postcss-nested; telegram-miniapp carries the same override and builds.

Lockfile regenerated with `npm install --package-lock-only`. Resolved versions: braces 3.0.4 (fork), source-map-js 1.2.2, postcss-selector-parser 7.1.7.

package.json

@@ -60,5 +60,10 @@
     "tailwindcss": "^3.4.11",
     "typescript": "^5.5.3",
     "vite": "^7.3.1"
+  },
+  "overrides": {
+    "braces": "npm:@pezkuwi/braces@^3.0.4",
+    "source-map-js": "^1.2.2",
+    "postcss-selector-parser": "^7.1.6"
   }
 }