chore(deps): dependency sweep

[apify-deps]

Summary

Dependency sweep — in-range freshening (all within existing ranges):

• @types/node ^24.13.3 → ^24.13.4
• vite ^8.2.2 → ^8.3.0
• zod ^4.5.4 → ^4.6.4 (input_secrets, validations)
• assorted transitive lockfile refresh (pnpm update -r)

✅ Dismissed (don't apply to our usage)

• smol-toml (high, DoS via malformed TOML) — not_used: pulled transitively via lerna → nx (nx pins smol-toml to an exact 1.6.1, below the patched 1.7.1, with no in-range fix available — even nx@22.7.12, the latest release compatible with our lerna@^9.0.7, still pins it). This repo's lerna.json sets useNx: false and no script invokes nx directly (build/test/lint all go through lerna run or plain tool CLIs), and the repo has no .toml files, so the vulnerable TOML-parsing path is never executed. (alert #166)

🧹 Overrides audited (no changes)

• esbuild, tar, js-yaml@4 — each still doing its job: removing it re-admits a vulnerable/old transitive pin (esbuild@0.27.7, tar@7.5.11, js-yaml@4.1.1, respectively, pulled in exactly by lerna/nx's own dependency pins). Kept as-is.

🤖 Generated with Claude Code