Fix frontend toolchain advisories

[dude2k]

Summary

• override transitive js-yaml to 4.3.1 because the current @hey-api parser pins vulnerable 4.2.0
• update nanoid from 3.3.17 to 3.3.18
• document the frontend toolchain security update

Root cause

@hey-api/json-schema-ref-parser@1.4.4 pins js-yaml 4.2.0, which is affected by GHSA-52cp-r559-cp3m and GHSA-5p4m-2wfm-xmqj. npm audit also identified nanoid 3.3.17.

Impact

These dependencies are build-time only and are not shipped as runtime Node modules, but the update removes known CPU-exhaustion findings from CI and development tooling.

Verification

• npm ci --ignore-scripts --no-audit --no-fund
• npm audit --omit=optional (0 vulnerabilities)
• npm run generate:api-types
• npm run lint
• npm run typecheck
• npm run test (63 passed)
• npm run build
• npm run check:embedded