chore(deps): refresh stale transitive dependencies to clear security alerts

[Daniel (dasanra)]

What it solves

pnpm-lock.yaml had not been re-resolved since June 2025, leaving many
transitive dependencies pinned below versions their parents' semver ranges
already permit. This refreshes those transitives to reduce open Dependabot
alerts.

Lockfile-only: package.json is unchanged and no pnpm.overrides were added,
so every version move is an in-range resolution — nothing is forced.

Changelog

• Refreshed stale transitive dependencies in pnpm-lock.yaml (54 changed, 3 added, 5 removed)
• Notable updates: dompurify, undici, mermaid, js-yaml, brace-expansion, basic-ftp, lodash-es, svgo, nanoid, flatted, katex, @babel/*
• Four cross-major moves, all in-range: estree-util-value-to-estree and estree-util-is-identifier-name (via remark-reading-time), uuid (via mermaid), ip-address (dev-only, via socks)
• Verified locally: pnpm typecheck, pnpm lint and pnpm build (359 pages exported) all pass

Checklist

• I've followed all safe-docs pull request rules

[github-actions]

Branch preview

✅ Deploy successful!

Website:
https://chore_refresh_lockfile_security_alerts--docs.review.5afe.dev