fix(deps): clear the high-severity advisories blocking publish (#90)

publish.yml's `pnpm audit --audit-level=high` gate failed on main, so
0.13.0 never published.

fast-uri was already pinned to ^3.1.4 for GHSA-v2hh-gcrm-f6hx and
GHSA-4c8g-83qw-93j6. A third advisory, GHSA-7p8r-x3mc-p8w7, has a floor
of 3.1.5 — the existing pin satisfied the two it was written for and
silently kept resolving below the new one. Raised to ^3.1.5.

Also pinned ip-address >=10.3.1 (GHSA-mwp4-54f8-5fhr, SSRF via
leading-zero octets, transitive through @modelcontextprotocol/sdk ->
express-rate-limit), and postcss >=8.5.18 / nanoid >=3.3.18 from the
vite + WXT toolchain. Those two are devDependencies and reach no
published tarball, but the gate does not distinguish.

Each override now carries its advisory ids, so the next person can tell
whether an entry is still needed instead of guessing.

vite moved 8.0.14 -> 8.2.1 within its existing ^8 range.

pnpm audit --audit-level=high now reports 0 high (3 low, 7 moderate).

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>