security: fix picomatch ReDoS and method injection vulnerabilities

[NeuroKoder3]

Summary

• Adds npm overrides to pin picomatch to ^4.0.4, resolving both open Dependabot alerts
• High: ReDoS vulnerability via extglob quantifiers (Dependabot TransTrack walkthrough, modeling transplant waitlist workflows and operational states #2)
• Medium: Method Injection in POSIX Character Classes causes incorrect Glob Matching (Dependabot Welcome to TransTrack Discussions, Purpose, Scope, and How to Engage #1)

Details

picomatch@4.0.3 is a transitive dependency of vite. Since it is not a direct dependency, an npm overrides field is used to force all instances to the patched version 4.0.4.

Test plan

• npm ls picomatch confirms all instances are at 4.0.4
• npm audit confirms no picomatch vulnerabilities remain
• CI status checks pass