fix(deps): bump postcss to safe version in lock file (GHSA-r28c-9q8g-f849)

[ferhimedamine]

Summary

• postcss ≤8.5.17 has a HIGH severity path traversal vulnerability (GHSA-r28c-9q8g-f849). It's a transitive dep — package.json unchanged, only package-lock.json updated via npm audit fix --package-lock-only.
• This is the same CVE fixed in dakera-ai-sdk via PR#21.
• esbuild LOW severity advisory (GHSA-g7r4-m6w7-qqqr) also remains but does NOT fail the --audit-level=high CI gate (exit 0 verified locally).

Why now

Dependabot PRs #54/#55/#56 all fail the security audit CI step on this CVE. Once this PR merges to main, a @dependabot rebase on each will pick up the fix and turn them green.

Test plan

• CI security audit passes (npm audit --audit-level=high exits 0)
• After merge: @dependabot rebase on chore(deps-dev): bump @dakera-ai/dakera from 0.11.103 to 0.11.104 #54, chore(deps-dev): bump @types/node from 25.7.0 to 26.1.2 #55, chore(deps-dev): bump @langchain/core from 1.1.46 to 1.2.3 #56 → all CI green

[ferhimedamine]

Merge blocked — needs non-ferhimedamine review (same as #53)

This is a pure security fix (package-lock.json only, automated npm audit fix --package-lock-only). Once CI passes (running now), it just needs 1 approving review from a non-ferhimedamine account.

After this merges: @dependabot rebase on #54, #55, #56 → all three will turn green (both the security audit and the vectorWeight code fix will be on base).