fix(deps): bump undici, postcss, browserslist and js-yaml in web/ui (security)

[fh-code-agent]

Clears the ten open Dependabot alerts against web/ui/yarn.lock. None of these
packages is a direct dependency of web/ui/package.json — all are transitive,
which is why grouped version updates never reached them.

What moved, and why each route was chosen

package	before	after	needed	route
undici	8.7.0	8.10.1	8.9.0	in range (^8.4.1, via node-gyp)
postcss	8.5.16	8.5.26	8.5.23	in range (^8.5.6, via vite)
browserslist	4.28.5	4.28.8	4.28.7	in range (^4.24.0, via @babel/helper-compilation-targets)
js-yaml	4.2.0	4.3.2	4.3.1	needs an override
nanoid	3.3.15	3.3.18	—	rode along with postcss

The first three are yarn up -R within their existing ranges. js-yaml could
not be: @redocly/openapi-core@^1.34.6 requires it as js-yaml: "npm:4.2.0"
— an exact pin, not a range — so there was no in-range target and Dependabot
could not raise a PR for it at all. That half is a resolutions entry in
web/ui/package.json:

"resolutions": {
  "js-yaml@npm:4.2.0": "4.3.2"
}

The key matches the one descriptor that actually exists in the lockfile
(verified: js-yaml@npm:4.2.0 was the only js-yaml@ stanza header), so it is
not a silent no-op. 4.3.2 is the head of the 4.x line (v4-legacy); latest is
5.4.1, a major that Redocly's pin does not anticipate.

Verification

Resolved versions after yarn install, read back out of the lockfile:

js-yaml      4.3.2      undici    8.10.1
postcss      8.5.26     browserslist  4.28.8

and the superseded versions are gone, not merely shadowed — grep -cF over
yarn.lock returns 0 for each of js-yaml@npm:4.2.0, version: 4.2.0,
version: 8.7.0, version: 8.5.16, version: 4.28.5.

yarn typecheck   exit 0
yarn test        88 tests, 8 files, all passed
yarn build       built in 8.20s
yarn gen:types   byte-identical to the committed src/api/tier-schema.d.ts

That last one is the one that mattered: gen:types runs
openapi-typescript → @redocly/openapi-core → js-yaml, so it exercises the
overridden package on the exact path Redocly pinned it for. Output unchanged.

[github-code-quality]

Code Coverage Overview

Languages: Go

Go / code-coverage/go

The overall line coverage in commit e62a3d7 in the deps/web-ui-security... branch remains at 71%, unchanged from commit ef1fd2b in the main branch.

Show a line coverage summary of the most impacted files.

File	main ef1fd2b	deps/web-ui-security... e62a3d7	+/-
internal/eventsourcing/host.go	70%	77%	+7%