chore(deps): pin four transitive deps to clear high advisories

`bun audit` (the release gate) reported 8 high advisories across four
transitive packages. Pinned via overrides, matching how undici was
handled in 4.19.4 — a plain `bun install` won't move them because the
lockfile pins hold.

- linkify-it  5.0.1 -> 5.0.2  (markmap-lib > markdown-it) — the only
  one on a runtime path. It IS bundled into main.js, but markmap-lib
  constructs `MarkdownIt()` with no options, so `linkify` defaults to
  false and the quadratic mailto: scan-loop is unreachable. Pinned
  anyway so the community directory scan comes back clean.
- postcss          8.5.15 -> 8.5.23  (dev: eslint-plugin-svelte, vite, vitest)
- brace-expansion  5.0.6  -> 5.0.8   (dev: eslint, typescript-eslint)
- fast-uri         3.1.2  -> 4.1.1   (dev: eslint > ajv)

Note linkify-it is pinned to ^5.0.2, not ^6: v6 drops the default
export markdown-it@5 imports, which breaks the esbuild bundle.

bun audit now reports no vulnerabilities.

Author: michaelpporter

bun.lock

@@ -70,7 +70,11 @@
 	},
 	"overrides": {
 		"vite": "8.0.16",
-		"undici": "^6.27.0"
+		"undici": "^6.27.0",
+		"postcss": "^8.5.23",
+		"brace-expansion": "^5.0.8",
+		"fast-uri": "^4.1.1",
+		"linkify-it": "^5.0.2"
 	},
 	"dependencies": {
 		"baseline-browser-mapping": "^2.11.0",