chore(deps): patch vulnerable dependencies (Dependabot/CodeQL)

- dompurify >=3.4.11 (runtime SVG sanitization)
- nanoid 4.x -> >=5.0.9 (vulnerable 4.0.x transitive; 3.x/5.x kept)
- undici >=8.5.0 (dev-only: jsdom/vitest/semantic-release; removes 8.4.1)
- rembg 2.0.69 -> 2.0.75 (Python AI sidecar, CPU + GPU)

js-yaml is already >=4.2.0; the residual 3.14.2 is gray-matter's build-time
pin (no 3.x patch exists). typecheck + build pass.

packages/ai/python/requirements-gpu.txt

@@ -1,4 +1,4 @@
-rembg==2.0.69
+rembg==2.0.75
 realesrgan==0.3.0
 paddleocr==2.9.1
 paddlepaddle-gpu==3.0.0

packages/ai/python/requirements.txt

@@ -1,4 +1,4 @@
-rembg[cpu]==2.0.69
+rembg[cpu]==2.0.75
 realesrgan==0.3.0
 paddleocr[doc-parser]>=3.4.0,<3.5.0
 paddlepaddle>=3.0.0,<3.1.0