Clear the website dev-dependency Dependabot alerts

On 2026-11-06, gh api repos/karlkfi/kube-headroom/dependabot/alerts listed 12 open alerts, all development scope in website/package-lock.json: vite (8, one high), source-map-js (high), @vue/server-renderer (high), postcss and esbuild. None of that code is in the image or charts; it builds the static site, and whether any alert matters to that build was not assessed.

Bump VitePress or the affected packages until the alerts close, then check the site with npm run docs:build.