fix(deps): update esbuild to 0.28.1 and tsx to 4.22.4

[dependabot]

Summary

The earlier esbuild 0.28.0 target was insufficient: GHSA-g7r4-m6w7-qqqr affects >=0.27.3 <0.28.1. This head resolves Dependabot alert #99 with the first patched release.

• Updates direct esbuild from ~0.27.3 (resolved 0.27.3) to ~0.28.1 (resolved 0.28.1).
• Updates tsx from ^4.21.0 (resolved 4.21.0, requiring esbuild ~0.27.0) to ^4.22.4 (resolved 4.22.4, requiring esbuild ~0.28.0) so npm deduplicates the tree to patched esbuild 0.28.1.
• Merges current origin/main at 26e553f7c and retains a two-file PR diff: templates/package.json and templates/package-lock.json.
• All esbuild platform packages, the direct dependency, tsx, and esbuild-sass-plugin resolve to/deduplicate on esbuild 0.28.1.

Validation (2026-09-18, head 20d055e59)

• Clean isolated npm ci --registry=https://packagefeedproxy.microsoft.io/npm/ --replace-registry-host=npmjs: passed; 687 packages installed and audited in 59 seconds. The HTTP log contains no registry.npmjs.org requests. The repository's explicit josecebe/twbs-pagination Git dependency retains its declared transport instead of being rewritten as a registry package.
• npm audit --registry=https://packagefeedproxy.microsoft.io/npm/ --json: no esbuild vulnerability; only unrelated existing bootstrap and colord findings remain.
• npm test: passed (3 tests).
• npm run lint: passed.
• npm run build: passed. Output contains existing Bootstrap/Sass deprecation warnings only; no esbuild warning was emitted.
• Windows advisory regression smoke: a raw GET /..\secret.txt request to esbuild serve returned HTTP/1.1 400 Bad Request, and the file outside the serve directory was not returned.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.