fix: resolve remaining 6 Dependabot alerts (transitive deps) (#8)

Updates form-data (critical, 4.0.6), picomatch, minimatch, and glob
within range, and forces postcss >=8.5.10 via npm overrides — Next.js
pins postcss 8.4.31 exactly even at 15.5.20, so the nested copy needs
an override ($postcss reference, deduped to the root 8.5.19).

Verified with npm run build.

Co-authored-by: t <t@t>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: 3 people