chore: clear npm audit gate broken by new upstream advisories

Two high advisories published after the last push failed CI's
npm audit --audit-level=high step, unrelated to any code change here:
- brace-expansion <=5.0.7 DoS (GHSA-mh99-v99m-4gvg), pulled in via
  rimraf@5 -> glob -> minimatch. rimraf only powered the clean script,
  so drop the whole chain and use node's built-in fs.rmSync instead
  (one less dev dependency, per the zero-dependency preference).
- postcss <=8.5.17 source-map path traversal (GHSA-r28c-9q8g-f849),
  transitive under vitest -> vite; npm audit fix bumped it within
  semver in the lockfile.

Production dependencies are untouched; npm audit is clean again.

Author: 鲁工