fix(deps): esbuild ^0.28.1 floors + vite 7→8 (rolldown) upgrade (#21517)

## What this does

Resolves the remaining esbuild security alerts on packages we own, and
upgrades the repo to **Vite 8** (which drops esbuild entirely in favour
of rolldown/oxc).

### 1. esbuild → `^0.28.1` (security)
- Raised the declared `esbuild` floor in `twenty-sdk` and the
logic-function common-layer (both were `^0.25.0`, which can only resolve
to a vulnerable version). These are our packages, so this is just
declaring the patched version — clears Dependabot **#1467** and
**#1468**.

### 2. Vite 7 → 8
- Bumped `vite` to `^8` in the 5 packages that declare it, and
`@vitejs/plugin-react-swc` to `^4.3.1` (the only plugin that needed a
bump for Vite 8; everything else already supports it).
- `twenty-front` keeps esbuild minification, so esbuild is now an
explicit (patched) devDependency there — Vite 8 no longer ships it.

### Two Vite-8 fallout fixes (bundler internals changed)
- **Storybook tests:** added React to `optimizeDeps.include` so Vite's
dep optimizer doesn't re-bundle React mid-run and break in-flight
imports in browser-mode tests.
- **`hex-rgb`:** it's ESM-only and broke rolldown's CJS interop (a
default import resolved to the wrong thing under jest). Replaced its one
use with a tiny inline hex→rgb parse and dropped the dependency.

## Verified
Vite resolves to a single `8.0.16` with no esbuild in its tree. Builds
pass on Vite 8/rolldown: `twenty-front` production build, the SDKs, and
Storybook; the previously-failing front and storybook test jobs now
pass; `yarn install --immutable` is clean.

## Note
This doesn't close root alert **#1469** — esbuild is still pulled by
other third-party tools (storybook, tsx, lingui, zapier, etc.) that
haven't shipped a patched release. The vulnerable code path (esbuild's
dev server) isn't used here, so that one is best dismissed as
not-affected.

packages/twenty-front/src/modules/ui/input/components/internal/date/components/DatePicker.tsx

@@ -341,7 +341,11 @@ type DatePickerPropsType = ReactDatePickerLibProps<
 
 const ReactDatePicker = lazy<ComponentType<DatePickerPropsType>>(() =>
   import('react-datepicker').then((mod) => ({
-    default: mod.default as unknown as ComponentType<DatePickerPropsType>,
+    // react-datepicker ships CJS; under vite 8 this dynamic import's `default`
+    // can be the module namespace ({ default: Component }) rather than the
+    // component itself, so unwrap a nested default when present.
+    default: ((mod.default as any)?.default ??
+      mod.default) as unknown as ComponentType<DatePickerPropsType>,
   })),
 );
 

packages/twenty-front/src/modules/ui/input/components/internal/date/components/DatePickerWithoutCalendar.tsx

@@ -316,7 +316,11 @@ type DatePickerPropsType = ReactDatePickerLibProps<
 
 const ReactDatePicker = lazy<ComponentType<DatePickerPropsType>>(() =>
   import('react-datepicker').then((mod) => ({
-    default: mod.default as unknown as ComponentType<DatePickerPropsType>,
+    // react-datepicker ships CJS; under vite 8 this dynamic import's `default`
+    // can be the module namespace ({ default: Component }) rather than the
+    // component itself, so unwrap a nested default when present.
+    default: ((mod.default as any)?.default ??
+      mod.default) as unknown as ComponentType<DatePickerPropsType>,
   })),
 );
 

packages/twenty-front/src/modules/ui/input/components/internal/date/components/DateTimePicker.tsx

@@ -353,7 +353,11 @@ type DatePickerPropsType = ReactDatePickerLibProps<
 
 const ReactDatePicker = lazy<ComponentType<DatePickerPropsType>>(() =>
   import('react-datepicker').then((mod) => ({
-    default: mod.default as unknown as ComponentType<DatePickerPropsType>,
+    // react-datepicker ships CJS; under vite 8 this dynamic import's `default`
+    // can be the module namespace ({ default: Component }) rather than the
+    // component itself, so unwrap a nested default when present.
+    default: ((mod.default as any)?.default ??
+      mod.default) as unknown as ComponentType<DatePickerPropsType>,
   })),
 );