fix(security): pin browserslist and postcss-selector-parser

[adubovikov]

Summary

• Pin transitive UI deps via existing overrides in src/ui/package.json: browserslist 4.28.7, postcss-selector-parser 7.1.3.
• Closes the three remaining Dependabot alerts:
  • GHSA-c83g-rgw3-j3cx / CVE-2026-73089 (high) — browserslist unbounded cache / OOM
  • GHSA-73wf-gq98-2v4g / CVE-2026-73088 (high) — browserslist crash via custom stats
  • GHSA-w9m9-85wc-3x92 / CVE-2026-9358 (low) — postcss-selector-parser AST recursion DoS

Both packages are build-time transitives (shadcn / Babel / PostCSS), not the Homer HTTP path. Go modules were already patched.

Test plan

• cd src/ui && npm ci succeeds with the new lockfile
• npm ls browserslist postcss-selector-parser shows 4.28.7 / 7.1.3
• npm run build still produces the UI
• Dependabot alerts 74, 73, 70 auto-close after merge