chore(deps): fix nanoid vulnerability and update dependencies within semver range

- Add a scoped pnpm override forcing postcss's transitive nanoid to
  >=3.3.18 <4, patching GHSA-2v37-7h3g-55p8 (indefinite loop in custom
  generators with size=0). Scoped to postcss's own dependency rather
  than the top-level nanoid so the app's own nanoid@5 usage is
  untouched.
- Update all other dependencies within their existing package.json
  semver ranges (tiptap, markdown-it, nodemailer, svelte-dnd-action,
  zod, sveltejs/kit, svelte, svelte-check, tsx and their @types).

pnpm audit: 1 high -> 0 vulnerabilities.

package.json

@@ -36,44 +36,44 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@sveltejs/adapter-node": "^5.5.7",
-    "@tiptap/core": "^3.29.2",
+    "@tiptap/core": "^3.31.0",
-    "@tiptap/extension-link": "^3.29.2",
+    "@tiptap/extension-link": "^3.31.0",
-    "@tiptap/extension-placeholder": "^3.29.2",
+    "@tiptap/extension-placeholder": "^3.31.0",
-    "@tiptap/extension-table": "^3.29.2",
+    "@tiptap/extension-table": "^3.31.0",
-    "@tiptap/extension-table-cell": "^3.29.2",
+    "@tiptap/extension-table-cell": "^3.31.0",
-    "@tiptap/extension-table-header": "^3.29.2",
+    "@tiptap/extension-table-header": "^3.31.0",
-    "@tiptap/extension-table-row": "^3.29.2",
+    "@tiptap/extension-table-row": "^3.31.0",
-    "@tiptap/extension-task-item": "^3.29.2",
+    "@tiptap/extension-task-item": "^3.31.0",
-    "@tiptap/extension-task-list": "^3.29.2",
+    "@tiptap/extension-task-list": "^3.31.0",
-    "@tiptap/extension-text-align": "^3.29.2",
+    "@tiptap/extension-text-align": "^3.31.0",
-    "@tiptap/extension-underline": "^3.29.2",
+    "@tiptap/extension-underline": "^3.31.0",
-    "@tiptap/pm": "^3.29.2",
+    "@tiptap/pm": "^3.31.0",
-    "@tiptap/starter-kit": "^3.29.2",
+    "@tiptap/starter-kit": "^3.31.0",
     "arctic": "^3.7.0",
     "argon2": "^0.43.1",
     "better-sqlite3": "^11.10.0",
     "drizzle-orm": "^0.45.2",
     "idb": "^8.0.3",
     "lucide-svelte": "^0.577.0",
-    "markdown-it": "^14.3.0",
+    "markdown-it": "^14.3.1",
     "nanoid": "^5.1.16",
     "node-diff3": "^3.2.1",
-    "nodemailer": "^9.0.3",
+    "nodemailer": "^9.1.0",
     "sanitize-html": "^2.17.7",
-    "svelte-dnd-action": "^0.9.77",
+    "svelte-dnd-action": "^0.9.79",
     "tiptap-markdown": "^0.9.0",
     "uuid": "^11.1.1",
-    "zod": "^4.4.3",
+    "zod": "^4.5.4",
     "zxcvbn": "^4.4.2"
   },
   "devDependencies": {
     "@playwright/test": "^1.62.1",
-    "@sveltejs/kit": "^2.70.2",
+    "@sveltejs/kit": "^2.70.3",
     "@sveltejs/vite-plugin-svelte": "^6.2.4",
     "@tailwindcss/typography": "^0.5.20",
     "@tailwindcss/vite": "^4.3.3",
     "@types/better-sqlite3": "^7.6.13",
-    "@types/markdown-it": "^14.1.2",
+    "@types/markdown-it": "^14.2.0",
     "@types/nodemailer": "^8.0.1",
     "@types/sanitize-html": "^2.16.1",
     "@types/uuid": "^10.0.0",
@@ -83,10 +83,10 @@
     "drizzle-kit": "^0.31.10",
     "jsdom": "^29.1.1",
     "nyc": "^18.0.0",
-    "svelte": "^5.56.8",
+    "svelte": "^5.57.0",
-    "svelte-check": "^4.7.4",
+    "svelte-check": "^4.7.6",
     "tailwindcss": "^4.3.3",
-    "tsx": "^4.23.5",
+    "tsx": "^4.23.13",
     "typescript": "^5.9.3",
     "vite": "^7.3.6",
     "vite-plugin-istanbul": "^7.2.1",
@@ -108,7 +108,8 @@
       "hono": ">=4.12.7",
       "devalue": ">=5.8.1",
       "path-to-regexp@8": ">=8.4.0",
-      "fast-uri": ">=3.1.2"
+      "fast-uri": ">=3.1.2",
+      "postcss>nanoid": ">=3.3.18 <4"
     }
   }
 }