fix: force undici >=6.24.1 via overrides to resolve high severity CVEs

Adds an npm overrides entry to pin undici to ^6.24.1, fixing 5 CVEs
introduced transitively via @codecov/vite-plugin → @actions/github/http-client.

- GHSA-g9mf-h72j-4rw9: unbounded decompression chain
- GHSA-2mjp-6q6p-2qxm: HTTP request/response smuggling
- GHSA-vrm6-8vpv-qv8q: unbounded memory in WebSocket deflate
- GHSA-v9p9-hfj2-hcw8: unhandled exception in WebSocket client
- GHSA-4992-7rv2-5pvq: CRLF injection via upgrade option

https://claude.ai/code/session_012Zv2tcMjWQWdMaR8Gwirap

Author: claude

package-lock.json

@@ -58,7 +58,8 @@
 		"typescript": "^5.9.3"
 	},
 	"overrides": {
-		"@projectwallace/css-parser": "$@projectwallace/css-parser"
+		"@projectwallace/css-parser": "$@projectwallace/css-parser",
+		"undici": "^6.24.1"
 	},
 	"engines": {
 		"node": ">=20"