chore: bump vite to 7.3.5

[jeanduplessis]

Summary

Bump Vite to 7.3.5 across the workspace catalog, packages, and root overrides to pick up upstream security fixes.

Why this change is needed

Vite 7.3.5 (2026-06-15) patches two dev-server security advisories affecting >= 7.0.0, <= 7.3.4:

• CVE-2026-53571 (High): server.fs.deny bypass on Windows alternate paths.
• CVE-2026-53632 (Medium): launch-editor NTLMv2 hash disclosure via UNC path handling on Windows.

Both only affect dev servers explicitly exposed to the network (--host), but pinning to the fixed release keeps our tooling off the vulnerable range.

How this is addressed

• Bump vite 7.3.2 → 7.3.5 in the root catalog and in packages/kilo-ui and packages/kilo-vscode.
• Add a root overrides entry pinning vite@7.3.5 so transitive dependents also resolve to the patched version.
• Update bun.lock to match.

Human Verification

bun turbo typecheck passed across all 19 TS packages locally (the JetBrains Gradle step was skipped — no JDK on this machine, unrelated to this change). No other manual verification performed; CI covers install and build.

Reviewer Notes

Human Reviewer Flags

• Dev-tooling security bump only; no runtime behavior change. No changeset added since this isn't user-facing — confirm that's acceptable.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (4 files)

• bun.lock
• package.json
• packages/kilo-ui/package.json
• packages/kilo-vscode/package.json

Mechanical dependency bump (vite 7.3.2 → 7.3.5) applied consistently across the catalog, root overrides, and both package manifests, with bun.lock updated to match. No logic changes. Dev-tooling-only change, so no changeset needed.

---

_{Reviewed by claude-sonnet-5-20260630 · Input: 14 · Output: 3.6K · Cached: 252.6K}

_{Review guidance: REVIEW.md from base branch main}