fix(security): bump pnpm.overrides.postcss 8.5.16 -> 8.5.18 to clear pnpm audit gate

[Roddygithub]

Closes Lint Web failure on main (pnpm audit HIGH: postcss <= 8.5.17 Path Traversal in sourceMappingURL).

What changes

1. web/pnpm-workspace.yaml: line bump postcss: 8.5.16 -> postcss: 8.5.18 (one line)
2. web/pnpm-lock.yaml: regenerated by pnpm install to reflect the new override

Why this is the right fix

• The existing repo convention for security overrides lives in web/pnpm-workspace.yaml (not web/package.json). The comment block above the overrides: section specifically calls out this exact mechanism: patches are pinned here until Next.js/Vitest bump their own lower-bounds.
• Pin exact 8.5.18 matches the existing line style (line 11 was postcss: 8.5.16, also a hard pin).
• No new top-level packages added; only postcss resolution updates transitively.

Verification

• pnpm exec tsc --noEmit -> 0 errors
• pnpm audit --audit-level=high -> clean (postcss no longer flagged as HIGH)
• pnpm list postcss -> resolves to 8.5.18 across next, vite, vitest transitively
• DCO: signed off (git commit -s)

Risk

• Minimal: postcss 8.5.17 -> 8.5.18 is a one-line patch release from the same author (Pavel Romanenko) shipping the sourceMappingURL fix. Internal CSS pipeline behavior is unchanged for next@16.x consumption.

Post-fix: can remove this override?

The comment block above the overrides: section says: "These can be removed once Next.js and Vitest update their own dependency ranges to pull in the patched versions natively." When next@>=16.x and vitest@>=3.x ship their own postcss>=8.5.18 lower-bounds, this override can be removed in a future PR.