chore(deps): patch-duty security bumps — faker, browserslist, fast-uri, qs, postcss-selector-parser (#157)

* chore(deps): patch-duty security bumps — faker, browserslist, fast-uri, qs, postcss-selector-parser

Weekly patch duty. Base: develop. Closes every fixable Dependabot alert via
transitive overrides:
- @faker-js/faker -> 10.5.0 (high)
- browserslist -> 4.28.7 (high)
- fast-uri -> 3.1.6 (high, 3 advisory ranges)
- qs -> 6.16.0 (medium)
- postcss-selector-parser 6 -> 6.1.3, 7 -> 7.1.3 (low)

Supersedes standalone Dependabot PR #154 (postcss-selector-parser).

Queued (need more than a lockfile bump):
- @tiptap/core family (medium, GHSA-cp6q-959q-f8rh) — the whole @tiptap/* set is
  on 3.22.4-3.30.3; the fix needs 3.30.4+ with @tiptap/extension-code-block-lowlight
  at 3.31.3 (flagged breaking), a coordinated ~35-package bump that must be verified
  against the block editor. Tracked for a separate, tested change.
- image-size (high) — no upstream fix exists.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016amyscuSg6tbhYVvuQJ2S3

* fix(deps): drop @faker-js/faker override — it broke the Docusaurus build

The @faker-js/faker ^10.5.0 override forced faker 10 into postman-collection
(via openapi-to-postmanv2, used at build time by dev-docs-openapi.js), which
pins faker 5.x. faker 10 dropped the legacy address shape, so postman-collection
crashed at config load: "Cannot read properties of undefined (reading 'city')".

postman-collection@5.x is the ONLY faker consumer in the tree, and it cannot use
faker 10 — so the advisory (GHSA on faker <=10.4.0) is not resolvable by an
override without upgrading openapi-to-postmanv2/postman-collection, which is out
of scope for a lockfile bump. faker runs only at build time on trusted OpenAPI
input. Queued as not-cleanly-fixable.

The other four bumps (browserslist, fast-uri, qs, postcss-selector-parser) stay.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016amyscuSg6tbhYVvuQJ2S3

---------

Co-authored-by: Nicolas Fry <nicolas@turbodocx.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: 3 people

package-lock.json

@@ -113,6 +113,11 @@
   },
   "overrides": {
     "@babel/core": "^7.29.6",
+    "browserslist": "^4.28.7",
+    "fast-uri": "^3.1.6",
+    "postcss-selector-parser@6": "^6.1.3",
+    "postcss-selector-parser@7": "^7.1.3",
+    "qs": "^6.16.0",
     "brace-expansion@1": "^1.1.16",
     "brace-expansion@2": "^2.1.3",
     "dompurify": "^3.4.13",