chore(deps): bump brace-expansion from 1.1.12 to 1.1.18 - #259

Takes the repository from 53 known advisories to 5. All five that remain have
no upstream fix: postcss (4) and sharp (1) are already at the latest published
version, so nothing to move to.

Resolves the substance of the open Dependabot PRs, which cannot themselves
survive this branch -- they carry yarn.lock diffs and cannot rebase onto a
tree with no yarn.lock.

Direct bumps of note:
- next 16.2.6 -> 16.2.11 (#254)
- sharp 0.34.5 -> 0.35.3 (#252)
- react / react-dom 19.1 -> 19.2.8, @types to match
- @serwist/build 9.2.1 -> 9.5.12 (#213)
- jest-environment-jsdom 30.2.0 -> 30.4.1 (#215)
- postcss 8.5.10 -> 8.5.26 (#257), @babel/core (#241), and the rest of the
  patch-updates group (#265) via in-range `pnpm update`
- @testing-library/jest-dom 6.6.3 -> 7.0.1. pnpm flagged 6.10.0 as a
  mis-published minor carrying breaking changes; 7.x is the clean line and
  its @testing-library/dom peer range is already satisfied.

Transitive advisories (nanoid #264, brace-expansion #259, fast-uri #258,
js-yaml #256, ws #247, form-data #236, tar #229 (the one CRITICAL),
minimatch #228, follow-redirects #222) were resolved by letting `pnpm update`
move the parents that pin them, rather than by pinning each child directly.

That distinction is the point of the one override this adds:

    socks: ^2.8.9

ip-address had two advisories. The chain is socks -> ip-address, and socks
2.8.5 pins `ip-address: ^9`. Overriding ip-address to ^10 would have handed
socks an API it does not expect -- precisely the failure that killed coverage
when the inherited glob override reached test-exclude@6. socks 2.8.9 already
declares `ip-address: ^10.1.1`, so bumping the parent lets the fixed child
arrive legitimately. Fix the package that declares the bad range, not the
package named in the advisory.

Also drops @eslint/compat and @eslint/eslintrc, which became dead when the
FlatCompat layer was removed, and annotates one more real
`react-hooks/set-state-in-effect` hit that eslint-plugin-react-hooks 7.1
newly detects in PromptComposer. Like the OpioidConverter one it is described
rather than fixed: it changes when a user's manual edits are discarded, and
the component has no test coverage.

NOT included, deliberately: tailwindcss 3 -> 4 (#214). That is a real
migration -- a new config format and a rewritten cascade layer model -- with
visual consequences on every page, and it belongs in its own PR with a human
looking at the result.

Verified: lint clean, typecheck clean, 4/4 tests with coverage, production
build 14.2s.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013RtsQWaEaAe4iVnSoUCDfY