chore(deps): clear npm audit — pdfjs-dist 6, react-router-dom, sanitize-html, katex, uuid

npm audit --omit=dev went from 11 advisories (6 high) to 0:
- pdfjs-dist 5.7.284 -> 6.3.289 (GHSA-hq66-cqwq-w95j, arbitrary JS on
  opening a malicious PDF; the client has an inline PDF viewer). Only API
  change for us: getDocument() no longer accepts a bare string.
- react-router-dom 7.15.1 -> 7.18.3 (open redirect, DoS, RSC advisories)
- sanitize-html 2.17.4 -> 2.17.7 (javascript: URI bypasses; not
  exploitable in our config per the audit, bumped anyway)
- katex 0.16.11 -> 0.16.47 (\htmlData attribute validation)
- uuid under @giphy/js-util overridden to >= 11.1.1 (giphy imports v4,
  which is unchanged)
- npm audit fix for transitive brace-expansion / js-yaml / nanoid / postcss

Verified: tsc clean, 1000 tests pass, production build succeeds and
dist/pdf.worker.min.js is still copied from the new package.

Fixes #24

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

package.json

@@ -1,7 +1,7 @@
 {
   "name": "lotus-chat",
   "version": "4.12.3-lotus",
-  "description": "Lotus Chat — Matrix client for Lotus Guild",
+  "description": "Lotus Chat \u2014 Matrix client for Lotus Guild",
   "main": "index.js",
   "type": "module",
   "engines": {
@@ -75,13 +75,13 @@
     "is-hotkey": "0.2.0",
     "jotai": "2.20.0",
     "jsqr": "1.4.0",
-    "katex": "0.16.11",
+    "katex": "0.16.47",
     "linkify-react": "4.3.3",
     "linkifyjs": "4.3.3",
     "matrix-js-sdk": "41.7.0",
     "matrix-widget-api": "1.17.0",
     "millify": "6.1.0",
-    "pdfjs-dist": "5.7.284",
+    "pdfjs-dist": "6.3.289",
     "prismjs": "1.30.0",
     "qrcode": "1.5.4",
     "qrcode.react": "4.2.0",
@@ -94,8 +94,8 @@
     "react-google-recaptcha": "3.1.0",
     "react-i18next": "17.0.8",
     "react-range": "1.10.0",
-    "react-router-dom": "7.15.1",
-    "sanitize-html": "2.17.4",
+    "react-router-dom": "7.18.3",
+    "sanitize-html": "2.17.7",
     "slate": "0.124.1",
     "slate-dom": "0.124.1",
     "slate-history": "0.113.1",
@@ -146,7 +146,8 @@
   },
   "overrides": {
     "@giphy/js-util": {
-      "dompurify": ">=3.3.4"
+      "dompurify": ">=3.3.4",
+      "uuid": ">=11.1.1"
     },
     "js-cookie": ">=3.0.6"
   }