[FIX] [Security] Bump vulnerable dependencies via npm overrides

[arturrybalskyy-dev]

📝 Description

Closes the majority of open Dependabot / npm audit alerts by pinning patched versions of vulnerable transitive dependencies through the overrides field in package.json. Only non-breaking fixes were applied.

🛠️ Changes Made

Package	Change	Severity
brace-expansion	5.0.8 → 5.0.9	high — DoS via unbounded intermediate arrays
fast-uri	3.1.4 → 3.1.5	high — host confusion via backslash authority
ip-address	10.2.0 → 10.5.0	high — SSRF / trust-boundary bypass (×3)
js-yaml	4.3.0 → 4.3.1	high — quadratic CPU in !!omap
js-yaml (under @istanbuljs/load-nyc-config)	3.15.0 → 3.15.1	high — same
nanoid	3.3.16 → 3.3.18	high — infinite loop on zero size
dompurify (via monaco-editor)	3.4.12 → 3.4.14	moderate — XSS via IN_PLACE hook removal
postcss	8.5.22 → 8.5.26	moderate — arbitrary .map read; also clears the whole stylelint / autoprefixer chain (13 alerts)
react-router-dom / react-router	6.30.4 → 6.30.6	moderate — open redirect via backslash (CVE-2026-53669)

---

✅ Checklist

• I have given the PR a well-structured title describing the domain and the specific change that was made
• I tested the changes in the browser (locally or via preview build)
• I confirmed that existing tests pass — vitest run: 30/30 files, 471/471 tests
• I added or updated unit / integration tests (if needed) — n/a, dependency-only change
• I checked that this change doesn't introduce new console warnings or lint / formatting errors — npm run lint clean, npm run build succeeds
• I updated the relevant Jira ticket with the appropriate details and status

---

🚨 Potentially Breaking Changes

• Yes
• No

---

Includes DRC change

• Yes
• No