chore(deps): resolve open Dependabot security alerts (#9456)

Bumps three dependencies flagged by Dependabot, closing all 7 open alerts:

- axios 1.16.0 -> 1.18.1 (catalog), closing 5 alerts:
  GHSA-gcfj-64vw-6mp9 (high, inherited proxy after interceptor config clone),
  GHSA-hcpx-6fm6-wx23, GHSA-mwf2-3pr3-8698, GHSA-f4gw-2p7v-4548,
  GHSA-xj6q-8x83-jv6g. Dependabot proposed 1.18.0; 1.18.1 is a pure bugfix
  release on top of it that also fixes runtime crashes and AxiosError
  circular-serialisation, so it is used instead. Supersedes PR #9447.

- brace-expansion 5.0.6 -> 5.0.7 (override), closing GHSA-3jxr-9vmj-r5cp
  (high, DoS via exponential-time expansion of consecutive {} groups).

- morgan -> 1.11.0 (new override), closing GHSA-4vj7-5mj6-jm8m (log forging
  via unneutralized control characters in :remote-user). Pulled in
  transitively by @react-router/serve.

Verified: check:types 28/28, check:lint 16/16, build 16/16.

Author: sriramveeraghanta

pnpm-lock.yaml

@@ -91,7 +91,7 @@ catalog:
   "@vitest/coverage-v8": "^4.1.8"
   "ast-types": "0.14.2"
   "autoprefixer": "^10.4.19"
-  "axios": "1.16.0"
+  "axios": "1.18.1"
   "buffer": "^6.0.3"
   "chroma-js": "^3.2.0"
   "class-variance-authority": "0.7.1"
@@ -195,7 +195,7 @@ overrides:
   mdast-util-to-hast: 13.2.1
   valibot: 1.2.0
   glob: 11.1.0
-  brace-expansion: 5.0.6
+  brace-expansion: 5.0.7
   nanoid: 3.3.8
   esbuild: 0.28.1
   "@babel/core": 7.29.7
@@ -237,6 +237,7 @@ overrides:
   "@opentelemetry/core": 2.8.0
   "@opentelemetry/resources": 2.8.0
   "@opentelemetry/sdk-trace-base": 2.8.0
+  morgan: 1.11.0
 
 allowBuilds:
   "@parcel/watcher": true