deps: puppeteer-core 25, and brace-expansion 2.1.7

@puppeteer/browsers 2.x unzips with extract-zip, which has an unpatched
path-traversal advisory; 3.x replaces it. brace-expansion's resolution
moves up to a patched 2.x. Build and the smoke test pass on the new
puppeteer.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: fuzzie360

package.json

@@ -51,7 +51,7 @@
   "devDependencies": {
     "@vitejs/plugin-react": "^4.3.4",
     "gh-pages": "^6.3.0",
-    "puppeteer-core": "^23.11.1",
+    "puppeteer-core": "^25.12.0",
     "sass": "^1.83.4",
     "vite": "^6.0.11"
   },
@@ -60,6 +60,6 @@
     "node-fetch": "^2.6.7",
     "node-gyp": "^11.5.0",
     "prismjs": "^1.30.0",
-    "brace-expansion": "^2.1.2"
+    "brace-expansion": "^2.1.7"
   }
 }