chore(deps): bump @tanstack/react-start from 1.168.35 to 1.168.60

[katsugtgz]

Updates @tanstack/react-start to address GHSA-qx66-fv34-fjm8.

Evidence:

• root package.json pinned @tanstack/react-start@1.168.35; pnpm-lock.yaml resolved @tanstack/react-start@1.168.35 and @tanstack/start-server-core@1.169.18
• osv-scanner reported GHSA-qx66-fv34-fjm8 (reflected XSS in TanStack Start server-function responses, CVSS 9.3) against both packages before the update

Changes:

• @tanstack/react-start from 1.168.35 to 1.168.60 in package.json and pnpm-lock.yaml
• @tanstack/start-server-core from 1.169.18 to 1.169.39 in pnpm-lock.yaml (required by react-start 1.168.60)
• the react-start 1.168.60 dependency subtree re-resolved some transitive packages (for example the @babel/* packages used by the router/vite plugin chain); they are part of the same lockfile resolution

Validation:

• osv-scanner no longer reports GHSA-qx66-fv34-fjm8 after the update. Scan comparison: 123 unique advisory IDs before, 122 after, no new advisory IDs introduced, and the only removed ID is the target
• osv-scanner reports no advisories for @tanstack/react-start@1.168.60 or @tanstack/start-server-core@1.169.39
• pnpm install --frozen-lockfile --ignore-scripts exits 0 on the updated lockfile

Scope: package.json and pnpm-lock.yaml only. No source code changes.

Note: the lockfile has pre-existing advisories for unrelated packages. This patch only clears GHSA-qx66-fv34-fjm8.