[codex] update vulnerable npm dependencies

[greenthree]

Summary

• refreshes the lockfile to remove the open Dependabot postcss alert ([codex] complete M0-M6 release hardening #1, GHSA-r28c-9q8g-f849)
• updates the vulnerable react-router / react-router-dom production pair
• resolves the remaining high-severity packages reported by the current npm audit snapshot

Dependency changes

• postcss: 8.5.17 -> 8.5.26
• react-router / react-router-dom: 7.18.1 -> 7.18.2
• nanoid: 3.3.16 -> 3.3.18
• js-yaml: 4.3.0 -> 4.3.1
• brace-expansion: 1.1.16 -> 1.1.18 and 5.0.7 -> 5.0.9

This is a lockfile-only change. It supersedes the stale PostCSS-only Dependabot PR #111; the existing handoff audit PR #146 is intentionally unaffected.

Validation

• npm ci
• npm audit --audit-level=high
• npm audit --omit=dev --audit-level=high
• npm run lint
• npm test
• npm run build
• git diff --check