Update dependencies to patch known vulnerabilities

bun update within existing semver ranges. Fixes advisories in dompurify
(XSS via detached-subtree hook removal, the markdown pipeline's
sanitizer), react-router-dom (open redirect, protocol-validation XSS,
inefficient-route-matching DoS), postcss, and nanoid.

Not fixed here: sharp (via @vercel/og, server-side OG image
generation) and undici (via jsdom, test-only) both need a breaking
major-version bump outside this update's semver ranges.

Author: euxaristia