Upgrade website dependencies and resolve npm audit advisories

[timhaintz]

Context

Follow-up to the website and thesis-alignment audit. Keep dependency remediation isolated from the content/data PR so framework and rendering regressions can be reviewed independently.

Current npm audit --omit=dev result: 9 production-path advisories (1 low, 4 moderate, 4 high, 0 critical). Affected dependency chains include:

• next (direct, high)
• @playwright/test / playwright (direct dev tooling reported in the audit chain, high)
• mermaid -> dompurify, lodash-es, uuid (moderate/high transitive issues)
• postcss and diff transitive advisories

Scope

• Determine the smallest supported upgrades that remove each advisory.
• Avoid npm audit fix --force unless every major-version change is reviewed explicitly.
• Confirm whether Playwright remains in production-path audit output after lockfile/package classification is corrected.
• Review Mermaid sanitization and diagram rendering after upgrade.
• Preserve the GitHub Pages static-export base path.

Acceptance criteria

• npm audit --omit=dev has no high or critical advisories; document any accepted lower-severity residual risk.
• Full Jest, lint, type-check, 33-case axe matrix, and GitHub Pages production build pass.
• Desktop, portrait mobile, and landscape/tablet screenshots show no regressions.
• CodeQL/code scanning and deployment checks are green before merge.

[timhaintz]

Post-merge baseline update (main at 2f33883):

• npm audit --omit=dev: 1 moderate, 0 high, 0 critical
• remaining production-path package: transitive dompurify via Mermaid
• Next.js is now 16.2.6 and PostCSS is patched via override
• full install audit still includes development/tooling findings, so the follow-up PR should distinguish runtime from dev-only exposure

Keep the acceptance criteria for full Jest, lint, type-check, 33-case axe matrix, GitHub Pages build, and responsive screenshots. The next PR can now focus primarily on Mermaid/DOMPurify plus dev-tooling advisories.