fix(deps): bump nanoid to 3.3.18 (Dependabot #17)

[CompleteDotTech]

What

Resolves Dependabot alert #17 (High): nanoid 3.3.17 — custom generators can loop indefinitely when size is zero. Patched in 3.3.18.

nanoid is not a direct dependency. pnpm-lock.yaml carried two copies:

• nanoid@3.3.17 — vulnerable, pulled in transitively by postcss
• nanoid@5.1.16 — unaffected, untouched

postcss declares a ^3.3.x range, so 3.3.18 is already admissible. A scoped pnpm override ("nanoid@3": "3.3.18") pins the transitive resolution so it lands on the patched release and no future resolution drifts back. The existing overrides are left intact.

Change

File	Change
package.json	+1 line: "nanoid@3": "3.3.18" added to pnpm.overrides
pnpm-lock.yaml	The overrides entry, the nanoid@3.3.17 → 3.3.18 package + snapshot entries, and the postcss@8.5.26 snapshot reference

Total: 6 insertions, 4 deletions across 2 files. No unrelated lockfile churn.

Rebased onto current main after the sibling dependency PRs (#4741 postcss, #4742 sharp, #4737 serde_with) landed. That rebase collapsed the second postcss@8.4.31 copy into postcss@8.5.26, so only one postcss snapshot reference remains to update.

Validation

Run from a clean checkout of this branch at 51a5dc9:

• pnpm install --frozen-lockfile — passes (lockfile consistent with package.json)
• pnpm lint — passes (design codemod check: 0 files with drift; eslint --max-warnings=0 clean)
• pnpm typecheck — passes (tsc --noEmit, no errors)
• pnpm build — passes, including the bundle-budget and standalone-budget postbuild gates
• grep -n "nanoid" pnpm-lock.yaml — no 3.3.17 anywhere; nanoid@3: 3.3.18 in overrides, nanoid@3.3.18 in packages + snapshots, the postcss snapshot on 3.3.18
• node -e "require('./node_modules/.pnpm/postcss@8.5.26/node_modules/nanoid/package.json').version" → 3.3.18 in the installed tree

CI on this head is fully green across all ten jobs, including the required Frontend build (Playwright: 282 passed, 3 skipped).