fix(deps): patch 13 Dependabot npm vulnerability alerts (#170)

Update package.json overrides so docs/package-lock.json no longer
resolves vulnerable versions:

- dompurify 3.4.0 -> 3.4.11 (alerts 88-94, 101)
- http-proxy-middleware -> 3.0.6 (alert 100, dev-server only)
- launch-editor -> 2.14.1 (alert 95)
- webpack-dev-server 5.2.4 -> 5.2.5 (alert 99)
- webpack-dev-server ws 8.20.1 -> 8.21.0 (alert 97)
- ws@^7 -> 7.5.11 for webpack-bundle-analyzer (alert 96)
- js-yaml@^4 -> 4.2.0 (scoped, alert 98 partial)

js-yaml uses a scoped override because gray-matter@4.0.3 pins
js-yaml@^3 (no 3.x patch exists) and calls safeLoad/safeDump,
removed in v4 — a blanket bump breaks the docs build.

Verified: `npm run build` passes clean with submodules initialized.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: BeArchiTek

docs/package-lock.json

@@ -42,21 +42,25 @@
     "typescript": "~5.6.2"
   },
   "overrides": {
-    "dompurify": "3.4.0",
+    "dompurify": "3.4.11",
     "fast-uri": "3.1.2",
     "follow-redirects": "1.16.0",
+    "http-proxy-middleware": "3.0.6",
     "joi": "17.13.4",
+    "js-yaml@^4.0.0": "4.2.0",
+    "launch-editor": "2.14.1",
     "lodash-es": "4.18.0",
     "mermaid": "11.15.0",
     "qs": "6.15.2",
     "serialize-javascript": "7.0.5",
     "shell-quote": "1.8.4",
     "uuid": "11.1.1",
+    "ws@^7.0.0": "7.5.11",
     "minimatch@<3.1.4": "3.1.4",
     "minimatch@>=9.0.0 <9.0.7": "9.0.7",
     "webpack-dev-server": {
-      ".": "5.2.4",
-      "ws": "8.20.1"
+      ".": "5.2.5",
+      "ws": "8.21.0"
     }
   },
   "browserslist": {