chore(deps): resolve open Dependabot / npm audit vulnerabilities in website

[danbaruka]

Summary

Open Dependabot alerts and npm audit findings in website/ need remediation.

Current signal (2026-09-11)

• Open Dependabot alerts: 44
• npm audit: 47 vulnerabilities (4 low, 5 moderate, 38 high)
• Packages involved: js-yaml, colord, svgo, qs, joi, browserslist, fast-uri, nanoid, mermaid, image-size (and related transitive parents)

Goals

1. Bump overrides / resolutions to patched versions where available
2. Bump direct mermaid to a patched release
3. Clear high/moderate audit findings where a fix exists
4. Keep website production build healthy (npm run build)

Acceptance criteria

• npm audit improved (ideally 0 high/critical when fixes exist)
• Dependabot alerts close or reduce after merge
• cd website && npm run build succeeds
• PR linked to this issue

Notes

• Prefer npm overrides + Yarn resolutions (repo uses both lockfiles)
• image-size may have no patched release yet; document if blocked upstream
• Supersedes open Dependabot chore(deps) bump PRs that only touch the same surface