fix(deps): patch nanoid in the site and telemetry lockfiles (#252)

GHSA-2v37-7h3g-55p8: customAlphabet and customRandom spin forever when
handed a size of 0. postcss already allows ^3.3.16, so 3.3.18 is a
lockfile-only move with no postcss, vite or astro change behind it.

Neither package is exposed. nanoid reaches the site through astro's
build-time vite and never enters dist/, which is all the Worker serves
alongside a dependency-free redirect script; in telemetry it is a dev
dependency of vitest. The alert is worth clearing anyway because the
fix costs three lines and leaves nothing to re-triage later.

telemetry had the same advisory auto-dismissed as dev-only (alert 150),
so it is patched here too rather than left as the one stale copy.

Refs: GHSA-2v37-7h3g-55p8, CVE-2026-67213

Author: Valtora