chore(site): patch three transitive advisories in the lockfile

Dependabot flagged js-yaml 4.3.0 (GHSA-5p4m-2wfm-xmqj, quadratic CPU in
!!omap resolution, high). `npm audit` found two more in the same tree:
nanoid <3.3.17 (GHSA-2v37-7h3g-55p8, high) and postcss <=8.5.22
(GHSA-fxqj-rqcc-2cmp, moderate).

All three are transitive under astro/starlight, so there is nothing to
change in package.json — `npm audit fix` moved the lockfile alone:
js-yaml 4.3.0 -> 4.3.1, nanoid 3.3.16 -> 3.3.18, postcss 8.5.22 ->
8.5.26. Patch bumps only; the declared deps are untouched.

The advisory title says the CVE-2026-59870 fix was not backported to
4.x, but 4.3.1 is the v4-legacy patch release that carries it.

Verified: `npm audit` reports 0 vulnerabilities, and `npx astro build`
builds all 11 pages with the link validator clean. Screenshots were not
regenerated — no /api shape changed, so docs/images/ is untouched.

Author: RAR