chore(deps): clear npm audit — pdfjs-dist 6, react-router-dom, sanitize-html, katex, uuid

npm audit --omit=dev went from 11 advisories (6 high) to 0:
- pdfjs-dist 5.7.284 -> 6.3.289 (GHSA-hq66-cqwq-w95j, arbitrary JS on
  opening a malicious PDF; the client has an inline PDF viewer). Only API
  change for us: getDocument() no longer accepts a bare string.
- react-router-dom 7.15.1 -> 7.18.3 (open redirect, DoS, RSC advisories)
- sanitize-html 2.17.4 -> 2.17.7 (javascript: URI bypasses; not
  exploitable in our config per the audit, bumped anyway)
- katex 0.16.11 -> 0.16.47 (\htmlData attribute validation)
- uuid under @giphy/js-util overridden to >= 11.1.1 (giphy imports v4,
  which is unchanged)
- npm audit fix for transitive brace-expansion / js-yaml / nanoid / postcss

Verified: tsc clean, 1000 tests pass, production build succeeds and
dist/pdf.worker.min.js is still copied from the new package.

Fixes #24

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

src/app/plugins/pdfjs-dist.ts

@@ -21,7 +21,8 @@ export const usePdfDocumentLoader = (pdfJS: typeof PdfJsDist | undefined, src: s
       if (!pdfJS) {
         throw new Error('PdfJS is not loaded');
       }
-      const doc = await pdfJS.getDocument(src).promise;
+      // pdfjs-dist 6 dropped the bare-string overload; pass the URL explicitly.
+      const doc = await pdfJS.getDocument({ url: src }).promise;
       return doc;
     }, [pdfJS, src]),
   );