fix: upgrade vulnerable seroval to 1.6.3

[danny-avila]

Summary

I upgraded the admin panel's transitive seroval dependency from 1.5.0 to Mend's recommended 1.6.3 to address the three vulnerabilities reported in https://github.com/ClickHouse/security-vulnerabilities/issues/1021 (CVE-2026-104845, CVE-2026-59940, and CVE-2026-104846).

• Pin seroval to 1.6.3 through a root override so every dependency path uses the patched version, including Solid's exact 1.5.0 requirement.
• Regenerate bun.lock with the published 1.6.3 integrity hash, preserving all unrelated package versions.

The dependency enters through @tanstack/react-router-devtools → @tanstack/router-core, @tanstack/react-start → its client/server cores, and @tanstack/react-devtools → @tanstack/devtools → solid-js, including the seroval-plugins peer path. bun pm why seroval now resolves these paths to 1.6.3. Mend should re-scan the merged dependency tree to confirm closure.

Change Type

• Bug fix (non-breaking change which fixes an issue)

Testing

• Pass bun install --frozen-lockfile.
• Confirm bun pm why seroval resolves a single version, 1.6.3.
• Pass bunx tsc --noEmit.
• Pass bun run test: 27 files, 1,215 tests.
• Pass bun run build: client and server production bundles. Build reports browser externalization of crypto and large chunk warnings.
• Pass git diff --check.

Test Configuration:

Bun 1.4.2; dedicated worktree based on current origin/main (bb88594).

Checklist

• My code adheres to this project's style guidelines
• I have performed a self-review of my own code
• Local unit tests pass with my changes