fix(security): pin nanoid >=3.3.17 in frontend lock

[seonghobae]

Buyer / security impact

Protected main@8dc746920c12988f082e914879d95e13c9693535 currently resolves the frontend build-tool chain to nanoid@3.3.16 through postcss. 3.3.16 is affected by GHSA-23h5-r75r-3v8j / CVE-2026-67213: customAlphabet / customRandom with size = 0 can loop indefinitely. The first patched version is 3.3.17.

This is a base-branch supply-chain defect, not part of the log-input responsibility boundary in PR #887. Do not widen #887 or merge the broad Figma/share hardening stack merely to carry this dependency fix.

Fresh evidence

• protected base: main@8dc746920c12988f082e914879d95e13c9693535
• frontend/package-lock.json: node_modules/nanoid = 3.3.16
• postcss dependency range = ^3.3.16
• frontend/package.json has no nanoid override on protected main
• historical remediation evidence in the inactive design stack showed 3.3.17 with npm integrity sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==; treat that as input, not current-head release evidence

Bounded remediation

Create a dependency-only branch from the then-current protected main and change only dependency/traceability artifacts needed for this advisory. Prefer a lockfile resolution to nanoid>=3.3.17; if an override is required for deterministic resolution, keep frontend/package.json and frontend/package-lock.json synchronized. Do not copy unrelated Figma, font, share-link, API, or documentation drift from PR #824.

Acceptance criteria

• RED evidence proves protected-main nanoid@3.3.16 is present / vulnerable before the change.
• npm ci succeeds from the committed lockfile.
• npm audit / repository supply-chain checks no longer report GHSA-23h5-r75r-3v8j.
• Frontend typecheck, tests, build, coverage-evidence, dependency-review, Trivy, OSV, Scorecard, Security Scan, SAST, Strix, Noema, and authenticated current-head OpenCode evidence are terminal-success where live policy requires them.
• No predecessor-head, skipped-required, or synthetic review evidence is accepted.
• Qualifying independent human approval is present after the final push, with all valid review threads resolved.

Design boundary

No buyer UI behavior changes. Live Figma/Storybook design-system authority therefore remains read-only for this slice; do not mutate tokens/components to remediate a build dependency.