build(deps): bump vite to 6.4.5, qs to 6.16.1 and postcss-selector-parser to 6.1.5 (#67)

sign: vite 6.4.5 fixes GHSA-8g5g-mxqh-grgj (dev server fs.deny bypass,
6.4.4 only); qs 6.16.1 comes in through the url polyfill.
web: qs 6.16.1, and an override pins the postcss-selector-parser that
@tailwindcss/typography requires exactly (6.0.10) to 6.1.5, which fixes
GHSA-rj75-hqrm-r3gf.

web/package.json

@@ -116,7 +116,10 @@
     "@pezkuwi/x-textencoder": "^14.0.26",
     "@pezkuwi/x-ws": "^14.0.26",
     "@pezkuwi/networks": "^14.0.26",
-    "elliptic": "^6.6.1"
+    "elliptic": "^6.6.1",
+    "@tailwindcss/typography": {
+      "postcss-selector-parser": "6.1.5"
+    }
   },
   "devDependencies": {
     "@eslint/js": "^9.9.0",