[codex] Remediate PostCSS audit finding

[biggora]

Summary

• Updated the locked postcss resolution from 8.5.15 to 8.5.23 via npm audit fix.
• Updated the transitive nanoid lockfile entry required by the new PostCSS release.
• Leaves package dependency constraints unchanged; this is a lockfile-only remediation.

Root Cause

tsup and vitest/vite resolve PostCSS through the dev dependency graph. The previous lockfile pinned postcss@8.5.15, which is affected by GHSA-r28c-9q8g-f849.

Verification

• npm audit --audit-level=high -> 0 vulnerabilities
• npm test -> 6 files passed, 42 tests passed
• npm run typecheck -> passed
• npm run build -> passed

[nahremenkova1]

QA SIGN-OFF

Recommendation: merged

Validation:

• GitHub CI: all required checks completed successfully (CodeQL and Unit Tests).
• Local audit: npm audit --audit-level=high found 0 vulnerabilities.
• Local tests: npm test passed (6 files, 42 tests).
• Local typecheck: npm run typecheck passed.
• Local build: npm run build passed.
• Patch review: lockfile-only PostCSS remediation; no source/API/runtime behavior changes.
• Coverage: not applicable; no source changes and no coverage report delta.
• Security hold: no SECURITY-HOLD comment present.