security(deps): upgrade esbuild to 0.28.1 to resolve dependabot alerts (#1323)

## Summary
Resolves the two open Dependabot alerts, both for transitive
(dev/build-only) `esbuild`, by upgrading to the patched **0.28.1**.

| GHSA | Severity | Issue |
|------|----------|-------|
| GHSA-gv7w-rqvm-qjhr | high | Missing binary integrity verification in
esbuild's Deno module (RCE via `NPM_CONFIG_REGISTRY`) |
| GHSA-g7r4-m6w7-qqqr | low | Dev-server path traversal / arbitrary file
read on Windows (`\`) |

## Changes
- Bump the `esbuild` pnpm override from `>=0.25.0 <0.28.0` to `>=0.28.1`
- Regenerate `pnpm-lock.yaml` (now resolves a single `esbuild@0.28.1`)

## Note on the previous cap
The `<0.28.0` cap was added in #1301 to avoid the esbuild 0.28.0
destructuring regression
([esbuild#4436](evanw/esbuild#4436)) that
broke the `@spotlightjs/website` build. Verified locally that **0.28.1
builds the website cleanly**, so the workaround is no longer needed and
the cap is removed.

## Verification
- `pnpm --filter @spotlightjs/website build` ✓ (no destructuring
regression)
- `pnpm build` (full turbo build) ✓
- `pnpm --filter @spotlightjs/spotlight build:sea` ✓
- Test suite ✓ (186/186)

Author: BYK

package.json

@@ -43,7 +43,7 @@
       "form-data": ">=4.0.4",
       "next": "^15.4.8",
       "cookie": ">=0.7.0",
-      "esbuild": ">=0.25.0 <0.28.0",
+      "esbuild": ">=0.28.1",
       "brace-expansion": ">=2.1.0 <3",
       "tmp": ">=0.2.6",
       "js-yaml": ">=4.1.1",