fix(site): remediate dependency advisories

[rochecompaan]

Summary

• Refresh the documentation site's lockfile with npm --prefix site audit fix --package-lock-only --ignore-scripts, resolving all reported site advisories with semver-safe updates.
• Keep PostCSS transitive rather than adding a direct dependency or override. It is brought in through Astro/Vite and Starlight/Expressive Code.
• Add a dedicated CI job that installs the site dependency tree, fails on high or critical advisories, and builds the Astro site.

The lockfile remediation also updates the other vulnerable transitive packages reported for the site, including js-yaml, nanoid, sharp, and svgo.

Scope

This change audits only the documentation site dependency tree. The unrelated advisories in the root development dependency tree are intentionally unchanged.

Verification

• npm --prefix site ci
• npm --prefix site audit --audit-level=high — 0 vulnerabilities
• npm --prefix site run build
• Prettier check
• git diff --check
• nix build

Closes #214