Fix npm security alerts and drop useless overrides

Regenerate the stale package-lock and pin patched versions for the
Dependabot-flagged packages (@vitest/browser, form-data, undici,
brace-expansion, js-yaml, esbuild, dompurify, @babel/core, vite,
@opentelemetry/core via posthog-js). Remove the harmful langsmith
override (it forced the vulnerable 0.5.x line) and the zero-effect
lodash-es override.

Signed-off-by: Sacha Al Himdani <sacha@probo.com>

package.json

@@ -24,19 +24,14 @@
     "turbo": "^2.9.14"
   },
   "overrides": {
-    "brace-expansion": "^5.0.5",
-    "minimatch@3": {
-      "brace-expansion": "^1.1.11"
-    },
     "minimatch@9": "^9.0.9",
-    "@langchain/classic": "^1.0.27",
-    "langsmith": "^0.5.19",
     "handlebars": "4.7.9",
+    "@langchain/classic": "^1.0.27",
     "@langchain/community": "^1.1.25",
     "lodash": "^4.18.1",
-    "lodash-es": "^4.18.1",
-    "axios": "^1.16.0",
-    "uuid": "^14.0.0"
+    "uuid": "^14.0.0",
+    "form-data": "^4.0.6",
+    "js-yaml": "^4.2.0"
   },
   "license": "MIT",
   "packageManager": "npm@11.8.0",