fix: bump nanoid to 3.3.18 (GHSA-2v37-7h3g-55p8, DEVX-8508)

[warp-agent-staging]

Summary

Bumps the transitive nanoid dependency from 3.3.16 to 3.3.18 to resolve GHSA-2v37-7h3g-55p8 (Dependabot alert 36): nanoid's custom generators (customAlphabet/customRandom) can loop indefinitely when size is 0.

This repo is on the nanoid 3.x line (patched in 3.3.18); the >= 4.0.0, < 5.1.6 range from the advisory (patched in 5.1.6) does not apply here.

Refs DEVX-8508.

Changes

• package-lock.json: node_modules/nanoid bumped 3.3.16 → 3.3.18 (version, resolved, integrity only).
• No package.json changes: nanoid is a transitive dependency of postcss (nanoid: ^3.3.12), which already permits 3.3.18, so no overrides entry was needed.
• No other dependency's resolved version changed; the diff to package-lock.json is exactly this one entry (3 lines changed).

Verification

• npm install — installs cleanly; npm ls nanoid confirms do-things > @tailwindcss/postcss > postcss@8.5.18 (overridden) > nanoid@3.3.18.
• npm audit — nanoid no longer appears in the vulnerability list. Remaining findings (postcss, brace-expansion) are pre-existing and tracked separately (e.g. fix: update postcss to resolve CVE-2026-69153 #25); unrelated to this change.
• npm run lint — passes (✔ No ESLint warnings or errors).
• npm run build — passes (next build compiles and generates pages successfully).
• Note: npm ci fails in this sandbox on both the base branch and this branch (pre-existing Missing: @emnapi/runtime@1.11.3 / @emnapi/core@1.11.3 from lock file, an optional-platform-dependency mismatch unrelated to nanoid); npm install was used instead for verification, per the "smallest change" guidance to avoid unrelated lockfile churn from a full regenerate.
• No UI change; no visual proof needed.

[warp-agent-staging]

This PR was generated with Warp.