Update postcss and nanoid to clear two high-severity advisories

[antoinekh]

Clears the two high-severity advisories npm audit reports for the website.

Package	Before	After	Advisories
postcss	8.5.15	8.5.26	GHSA-fxqj-rqcc-2cmp, GHSA-r28c-9q8g-f849
nanoid	3.3.12	3.3.18	GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8

Exposure

Limited. Both are transitive dependencies of vite, which is a devDependency:

vite@6.4.3 -> postcss@8.5.15 -> nanoid@3.3.12

So they only ever ran on the build machine. Neither is bundled into the site, and no visitor of network-secret.pages.dev was exposed to either issue.

Scope of the change

Lockfile only, 7 lines. web/package.json is untouched: no direct dependency was added or removed, and no version range changed. The upgrade is semver-compatible within the existing vite range, so it needed npm audit fix rather than npm audit fix --force.

Verification

npm audit reports 0 vulnerabilities. Web suite 144 tests, npm run check clean at zero warnings, npm run build succeeds, Python suite 140 tests.

Note on merge order

This branches from master, independently of PR #6. Both touch web/package-lock.json, so whichever merges second will conflict there. Resolving it is a matter of taking the merged lockfile and running npm install; there is no semantic overlap, since this PR changes only transitive build-tool versions and #6 adds bcryptjs.

[cloudflare-workers-and-pages]

Deploying network-secret with    Cloudflare Pages

Latest commit:	84f421b
Status:	✅  Deploy successful!
Preview URL:	https://5afeb7ee.network-secret.pages.dev
Branch Preview URL:	https://fix-npm-audit-advisories.network-secret.pages.dev

View logs