chore(deps): bump esbuild 0.25 → current, on its own #1204

Split out of #987.

esbuild is pinned exactly at 0.25.12 and used in electron.vite.config.ts and scripts/check-extension-frames.mjs. Below 1.0, a minor version bump counts as breaking, and 0.28 is three of them. It's also the package npm 10 and npm 11 used to place differently in the lockfile (#1042). #1195 removed the nested 0.28 copy that caused that.

Change

Bump to the current 0.2x on its own, and check:

• the build (npm run build:app, node scripts/verify-build-output.mjs);
• the extension frame check;
• that npm ci accepts the lockfile under both npm 10.9 and npm 11.

Then remove esbuild from the Dependabot exclude-patterns list.