fix: clear npm audit vulnerabilities

[stigrunar]

Summary

• bump Vite consumers in web and bootstrap installer to patched Vite 8.0.16
• bump ui-tui/@hermes/ink esbuild to 0.28.1 and refresh the lockfile so transitive esbuild resolves to 0.28.1
• bump desktop wait-on so Joi resolves to 18.2.1

Verification

• npm audit --workspace web --audit-level=moderate
• npm audit --workspace ui-tui --audit-level=moderate
• npm audit --audit-level=moderate
• npm run build --workspace web
• npm run build --workspace apps/bootstrap-installer
• npm run build --workspace ui-tui
• npm run build --prefix ui-tui/packages/hermes-ink
• npm run typecheck --workspace ui-tui
• npm run typecheck --workspace apps/desktop
• npm run typecheck --workspace apps/bootstrap-installer

Notes

• npm test --workspace ui-tui currently fails in unrelated TUI layout tests: virtualHeights expected 3/received 4 and cursorDriftRegression timeout. The initial run also needed @hermes/ink dist/entry-exports.js to be built first.

[alt-glitch]

Duplicate of #46543 — same npm audit clearing (Vite 8 / esbuild 0.28.1 / Joi bumps across web, ui-tui, hermes-ink, bootstrap-installer). #46543 is the earlier open twin; a maintainer salvage (#46652) clearing the same esbuild/Vite audit loop was also merged to main.

[teknium1]

Thanks for the dependency-audit cleanup. This is now superseded by the remediation already on main; automated hermes-sweeper review recommends closing this duplicate.

• 92a456f711ebbc7dba083094f7fc91f1dfd54904 (fix(cli,deps): clear esbuild audit loop) is on current main and upgraded the same web, TUI, and bootstrap-installer Vite/esbuild surfaces.
• Current package-lock.json resolves esbuild to 0.28.1 (package-lock.json:10313), vite to 8.1.0 (package-lock.json:18849), wait-on to 9.0.10 (package-lock.json:19035), and joi to 18.2.3 (package-lock.json:12959).
• This matches the maintainer's duplicate note linking the merged salvage in fix(cli,deps): clear esbuild audit loop #46652 (merge commit 29c6985590043fc672a6c9a7cdb9a8695388d1ac).