chore(deps): force patched socket.io-parser into client bundle

Audit of the full transitive tree found that of the flagged production
advisories, only socket.io-parser (and uuid) actually ship in the browser
bundle. socket.io-parser <4.2.6 (via @metamask/sdk's socket.io client) has
a memory-exhaustion DoS reachable from a malicious socket.io server; pin it
to >=4.2.6 via a pnpm override.

The remaining flagged transitives do not reach the browser bundle (h3, ws,
defu, preact tree-shaken or Node-only; picomatch, postcss build-time only)
and uuid's vulnerable path (buf arg with v3/v5/v6) is not exercised, so
they are left to resolve via upstream wallet-SDK updates.

Verified: production build passes, pnpm audit --prod reports 0
socket.io-parser advisories.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: PatrickAlphaC