Patch the dev-tool dependencies Dependabot flagged

Moves brace-expansion, source-map-js, esbuild (through tsx),
postcss-selector-parser and @modelcontextprotocol/server to patched
versions. Also takes vite 7.3.7 and vitest 4.1.12 for advisories
npm audit reports that have no Dependabot alert yet.

- tsx 4.19.2 -> 4.23.14 drops its nested esbuild 0.23.1 and dedupes
  with the copy e2e already pins.
- Override @modelcontextprotocol/server to 2.3.1, the version e2e
  0.21.2 ships with. e2e 0.17.0 pins 2.2.0 exactly.
- Override postcss-selector-parser to 7.1.7. Tailwind 3 asks for ^6,
  but the built CSS is byte-identical to the 6.x build.
- brace-expansion and source-map-js are lockfile refreshes inside
  their existing ranges.

braces (via tailwindcss 3) and sprintf-js (via mammoth's argparse)
have no patched release, so they stay.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: Programcode