chore: clear high-severity npm advisories

- react-router/react-router-dom 7.17.0 -> 7.18.1 (route-matching DoS,
  GHSA-chx6-hx7r-mcp5)
- axios 1.16.1 -> 1.18.1 (inherited-proxy leak, GHSA-gcfj-64vw-6mp9)
- postcss 8.5.15 -> 8.5.23 (source-map path traversal, GHSA-r28c-9q8g-f849)
- brace-expansion pinned to 1.1.16 / 2.1.2 across all nested copies via
  overrides (exponential-expansion DoS, GHSA-3jxr-9vmj-r5cp)

Remaining GHSA-qwww-vcr4-c8h2 (react-router RSC-mode CSRF) is dismissed
on GitHub as not-used: the app is a Vite SPA, RSC mode is never enabled,
and the fix requires a react-router v8 major upgrade.

web/package.json

@@ -69,5 +69,9 @@
     "*.{css,json}": [
       "prettier --write"
     ]
+  },
+  "overrides": {
+    "brace-expansion@1": "~1.1.16",
+    "brace-expansion@2": "~2.1.2"
   }
 }