chore(deps): override dompurify to 3.4.14 (GHSA-c2j3-45gr-mqc4)

[1688mengdie]

Summary

pnpm-lock.yaml pins dompurify 3.3.1, which is affected by the DOM
clobbering XSS advisory GHSA-c2j3-45gr-mqc4 (fixed in 3.4.8) and two low
severity advisories GHSA-vxr8-fq34-vvx9 and GHSA-gvmj-g25r-r7wr. Every
importer in the workspace resolves the vulnerable release through the
lockfile.

This PR adds a workspace-level pnpm override pinning dompurify to
3.4.14 and lets pnpm regenerate the lockfile, so every importer resolves
the patched release. The regenerated lock also carries pnpm 10.15.0
serialization metadata (optional platform annotations), which introduces
no version changes.

Fixes #2631

Type and Areas

Type: security fix

Areas: Dependencies (Web UI)

Verification

• pnpm install --frozen-lockfile — Already up to date, exit 0.
• pnpm --dir src/web-ui run type-check — exit 0.
• pnpm --dir src/web-ui run lint — exit 0.
• vitest Markdown suite (incl. MermaidBlock render chain) — 14 passed.
• pnpm run frontend:build-all — exit 0.

Reviewer Notes

• The override is additive in pnpm-workspace.yaml (one line); the
  lockfile diff is the pnpm install regeneration product and was
  audited hunk by hunk (dompurify semantic hunks + pnpm regeneration
  metadata; zero unintended version changes).
• Rollback is a revert of the two-file change.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above, or skipped checks are explained.
• User-facing strings, docs, and locales are updated where applicable. (Not applicable: no user-facing change.)

This is an AI-assisted change.