fix(deps): bump nanoid to 3.3.18 for GHSA-2v37-7h3g-55p8

[rlorenzo]

What

Bumps transitive nanoid from 3.3.16 to 3.3.18 in both lockfiles, clearing Dependabot alert #164 (GHSA-2v37-7h3g-55p8, custom generators loop indefinitely when size is zero).

Lockfiles only, no manifest change: postcss's range is ^3.3.x, so npm update nanoid satisfies it.

Reach

• Root package-lock.json: dev-only, via postcss.
• VueApp/package-lock.json: in the production tree via vue-router -> @vue/compiler-sfc -> postcss. postcss calls nanoid with fixed non-zero sizes, so the zero-size loop is not reachable through our usage.

Testing

npm run verify:build passes, npm run test:frontend 1121/1121, npm run test:backend 2708/2708.

[codecov-commenter]

Bundle Report

Bundle size has no change ✅

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 41.74%. Comparing base (21551ff) to head (876821a).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #314   +/-   ##
=======================================
  Coverage   41.74%   41.74%           
=======================================
  Files         992      992           
  Lines       49697    49697           
  Branches     5854     5854           
=======================================
  Hits        20748    20748           
  Misses      28038    28038           
  Partials      911      911           

Flag	Coverage Δ
backend	39.80% <ø> (ø)
frontend	58.15% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.