web: drop zod and @hookform/resolvers, which nothing imports; vite 7.3.7 (#63)

Neither package is imported anywhere in web/ or shared/. They reached the
production bundle only because vite.config.ts named them in the "forms"
manual chunk, which forces a module into the build whether or not any
code uses it. #61 moved zod to 4.6.7 to clear the advisory; removing it
takes the package out of the shipped bundle altogether (abitype declares
it as an optional peer, so nothing installs it). The "forms" chunk now
holds react-hook-form alone.

vite 7.3.7 (2026-10-06) closes the launch-editor advisories on 7.0.0-7.3.6
(Dependabot #313-#315). They reach only the dev server, but the alerts
are real. Typecheck ratchet 335/335, 32 tests, build green.

web/package.json

@@ -21,7 +21,6 @@
     "prepare": "husky"
   },
   "dependencies": {
-    "@hookform/resolvers": "^3.9.0",
     "@noble/ciphers": "^2.1.1",
     "@noble/curves": "^2.0.1",
     "@noble/hashes": "^2.0.1",
@@ -90,8 +89,7 @@
     "sonner": "^1.5.0",
     "tailwind-merge": "^2.5.2",
     "uuid": "^11.1.0",
-    "vaul": "^0.9.3",
-    "zod": "^4.6.7"
+    "vaul": "^0.9.3"
   },
   "overrides": {
     "@pezkuwi/api": "^16.5.39",
@@ -147,7 +145,7 @@
     "tailwindcss-animate": "^1.0.7",
     "typescript": "^5.5.3",
     "typescript-eslint": "^8.0.1",
-    "vite": "^7.3.1",
+    "vite": "^7.3.7",
     "vite-plugin-node-polyfills": "^0.25.0",
     "vite-plugin-subresource-integrity": "^0.0.12",
     "vitest": "^4.1.11"