chore(deps): bump transitive deps to clear dependabot alerts

Raise resolution pins to the patched versions for 14 open Dependabot
alerts (1 critical, 8 high, 5 medium):

- brace-expansion 1.1.14 -> 1.1.16, 2.1.0 -> 2.1.2, 5.0.7 -> 5.0.8 (DoS)
- tar 7.5.16 -> 7.5.22 (decompression DoS, infinite loop, PAX crashes)
- postcss 8.5.15 -> 8.5.23 (source map path traversal)
- fast-uri 3.1.2 -> 3.1.4 (host confusion)
- sharp 0.34.5 -> 0.35.3 (inherited libvips CVEs)
- shell-quote 1.8.4 -> 1.9.0 (quadratic parse DoS)
- js-yaml 4.2.0 -> 4.3.0 (merge-key CPU exhaustion)

The two react-router advisories (GHSA-wrjc-x8rr-h8h6, GHSA-337j-9hxr-rhxg)
are not addressed: they are only patched in 7.18.0 and 6.30.4 is the final
v6 release, so clearing them needs a v6 -> v7 migration.

package.json

@@ -189,17 +189,21 @@
     "follow-redirects": "1.16.0",
     "@libp2p/gossipsub": "16.0.4",
     "@libp2p/kad-dht": "16.2.6",
-    "brace-expansion@npm:^5.0.2": "5.0.7",
-    "brace-expansion@npm:^5.0.5": "5.0.7",
+    "brace-expansion@npm:^1.1.7": "1.1.16",
+    "brace-expansion@npm:^2.0.1": "2.1.2",
+    "brace-expansion@npm:^2.0.2": "2.1.2",
+    "brace-expansion@npm:^5.0.2": "5.0.8",
+    "brace-expansion@npm:^5.0.5": "5.0.8",
     "protobufjs": "7.6.5",
     "@protobufjs/utf8": "1.1.1",
     "@babel/core": "7.29.6",
     "@babel/plugin-transform-modules-systemjs": "7.29.4",
     "axios": "1.18.0",
     "form-data": "4.0.6",
-    "js-yaml": "4.2.0",
+    "js-yaml": "4.3.0",
     "baseline-browser-mapping": "^2.9.11",
     "vite": "8.0.16",
+    "postcss": "8.5.23",
     "qs": "6.15.0",
     "mdast-util-to-hast": "12.3.0",
     "node-forge": "1.4.0",
@@ -208,7 +212,7 @@
     "elliptic": "6.6.1",
     "ws": "8.21.0",
     "jose": "4.15.9",
-    "sharp": "0.34.5",
+    "sharp": "0.35.3",
     "cacache": "19.0.1",
     "preact": "10.27.3",
     "@remix-run/router": "1.23.2",
@@ -218,7 +222,7 @@
     "@xmldom/xmldom": "0.8.13",
     "ajv@npm:^8.6.0": "8.18.0",
     "ajv@npm:^8.11.0": "8.18.0",
-    "fast-uri": "3.1.2",
+    "fast-uri": "3.1.4",
     "ip-address": "10.1.1",
     "bn.js@npm:^4.0.0": "4.12.3",
     "bn.js@npm:^4.1.0": "4.12.3",
@@ -228,12 +232,12 @@
     "minimatch@npm:^3.0.5": "3.1.4",
     "seroval": "1.4.1",
     "smol-toml": "1.6.1",
-    "tar": "7.5.16",
+    "tar": "7.5.22",
     "yauzl": "3.4.0",
     "serialize-javascript": "7.0.5",
     "esbuild": "0.28.1",
     "esbuild@npm:^0.25.0": "0.28.1",
-    "shell-quote": "1.8.4",
+    "shell-quote": "1.9.0",
     "@tootallnate/once": "3.0.1",
     "rollup": "2.80.0",
     "@electron/asar": "4.0.1",