website: upgrade Hexo toolchain to patch npm vulnerabilities

Bump hexo 5.4.0 -> 8.1.2 and all renderer/generator plugins (and serve)
to their latest majors, then regenerate package-lock.json. Local
'npm audit' now reports 0 vulnerabilities, down from the 46 open
Dependabot alerts (all in this build-time dependency tree -- none of it
ships to readers). The GitHub Dependabot alerts should auto-close once
this lands on master and is rescanned.

Two fixes were needed to keep the site building under the new toolchain:
- Quote the title in book/en-us/09-others.md. Hexo 8's stricter js-yaml
  rejects the unquoted 'Chapter 09: Minor Features' (the second colon
  parses as a nested mapping); every other chapter title was already
  quoted.
- Set marked.prependRoot: false. hexo-renderer-marked 6+ prepends the
  site root to relative image paths by default, turning the book's
  ../../assets/figures/*.png into a broken /../../assets/... path. This
  restores the original relative paths.

Verified locally (Node 25): full build succeeds with no errors, all 32
chapter pages plus homepage/about render, syntax highlighting and image
captions intact, no broken image paths in the output. NOT yet verified
in CI -- see the build-env image note in the following commit.

Author: changkun

book/en-us/09-others.md

@@ -1,5 +1,5 @@
 ---
-title: Chapter 09: Minor Features
+title: "Chapter 09: Minor Features"
 type: book-en-us
 order: 9
 ---

website/_config.yml

@@ -68,4 +68,8 @@ marked:
   tables: true
   breaks: false
   smartLists: true
-  smartypants: false
+  smartypants: false
+  # hexo-renderer-marked 6+ prepends the site root to relative image paths
+  # by default, which turns the book's ../../assets/... figures into a broken
+  # /../../assets/... absolute path. Keep the original relative paths.
+  prependRoot: false