fix: mitigate npm dependency advisories

package.json

@@ -11,6 +11,7 @@
     "start:local": "powershell -NoProfile -ExecutionPolicy Bypass -File tools/start-local.ps1",
     "start:local:minio": "powershell -NoProfile -ExecutionPolicy Bypass -File tools/start-local.ps1 -OnlyMinio",
     "prisma:generate": "npm --prefix api run prisma:generate",
+    "security:verify": "node tools/security/verify-dependency-mitigations.mjs",
     "spike:contracts": "node tools/spike/validate-gateway-queue-contract.mjs",
     "spike:gateway": "powershell -NoProfile -ExecutionPolicy Bypass -Command \"$env:Path='C:\\Program Files\\Go\\bin;'+$env:Path; Push-Location gateway; go test ./...; Pop-Location\"",
     "spike:bullmq": "node api/src/spike/bullmq-link-spike.mjs",
@@ -34,7 +35,7 @@
     "lucide-react": "^1.18.0",
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
-    "react-router-dom": "^7.18.1",
+    "react-router-dom": "7.18.1",
     "vite": "^8.0.16",
     "zustand": "^5.0.14"
   },
@@ -43,5 +44,8 @@
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
     "typescript": "^6.0.3"
+  },
+  "overrides": {
+    "postcss": "8.5.23"
   }
 }