fix: override yauzl to 3.2.1 to resolve moderate vulnerability

yauzl <3.2.1 has an off-by-one error (GHSA-gmq8-994r-jv83).
Transitive dependency via puppeteer → @puppeteer/browsers → extract-zip.
npm overrides pins yauzl@3.2.1 without changing puppeteer version.
npm audit now reports 0 vulnerabilities.

package.json

@@ -41,5 +41,8 @@
     "typescript": "^5.9.3",
     "vitest": "^4.1.0"
   },
-  "type": "module"
+  "type": "module",
+  "overrides": {
+    "yauzl": "3.2.1"
+  }
 }