fix(deps): clear 14 remaining dependabot advisories in website

[maxholman]

Summary

Sweep of `website/` dependencies to clear all 14 remaining dependabot advisories. Drops the redundant vite 8 lineage (we already pull patched vite 7.3.2 transitively from astro) to dodge a rolldown regression with `@tailwindcss/vite`.

Closes

#28 #29 #30 #31 #33 #34 #35 #36 #37 #38 #39 #40 #44 #48

Direct dep changes (package.json)

package	before	after
astro	^6.0.6	^6.2.2
@astrojs/markdoc	^1.0.2	^1.0.4
@astrojs/sitemap	^3.7.1	^3.7.2
@iconify-json/lucide	^1.2.98	^1.2.105
@tailwindcss/vite	^4.2.2	^4.2.4
astro-pagefind	^1.8.5	^1.8.6
satori	^0.25.0	^0.26.0
tailwindcss	^4.2.2	^4.2.4
oxfmt (dev)	^0.41.0	^0.48.0
oxlint (dev)	^1.56.0	^1.63.0
vite (dev)	^8.0.1	^7.3.2
wrangler (dev)	^4.75.0	^4.88.0

The vite downgrade is the only "non-trivial" change — see context below.

Why downgrade vite from 8 to 7

`pnpm update --latest` pushed vite to 8.0.10 (and the patched-but-still-bumped 8.0.5), both of which fail the build with:

```
[@tailwindcss/vite:generate:build] Missing field `tsconfigPaths` on BindingViteResolvePluginConfig.resolveOptions
```

That's a rolldown regression in vite 8's bundler when paired with `@tailwindcss/vite@4.2.4`. `@tailwindcss/vite`'s peer-dep range covers vite 5–8, so dropping back to 7 is supported. Astro pulls vite 7.3.2 transitively anyway (which is the patched version that closes alerts #36 #37 #38), so the direct devDep just aligns with the version we already use.

Release

The `fix(deps):` commit triggers another patch release (`v0.15.1` -> `v0.15.2`) on merge.

Verified

• `pnpm build` (`astro build`) succeeds — 21 pages built
• No more vite 8 in the resolved tree
• yaml@2.x no longer in the lockfile (was an optional vite peer; now omitted)
• All 14 alert packages at or above their patched versions

How to verify

• After merge, confirm the 14 dependabot alerts auto-close at https://github.com/block65/wallhack/security/dependabot
• Run `pnpm -C website install && pnpm -C website build` locally