chore(website): clear all npm audit findings via lockfile refresh

[infocentr]

Summary

package.json is untouched — this regenerates website/package-lock.json so every flagged transitive resolves to its patched release. npm audit goes from 9 vulnerabilities (2 high, 6 moderate, 1 low) to 0:

Package	Severity	Advisory
undici	high	TLS certificate validation bypass; Set-Cookie header injection
ws	high	Memory-exhaustion DoS via tiny fragments
webpack-dev-server	moderate	HMR WebSocket interception
http-proxy-middleware	moderate	Host confusion via substring router matching
launch-editor	moderate	NTLMv2 hash disclosure via UNC paths (Windows)
dompurify	moderate	IN_PLACE nodeName trust; hook mutation of allowlists
joi	moderate	Uncaught RangeError on deeply nested input
js-yaml	moderate	Quadratic-complexity DoS in merge-key handling
@babel/core	low	Arbitrary file read via sourceMappingURL comment

The newer @types/react resolution removes the global JSX namespace, so the two components returning JSX.Element now use React.JSX.Element, with a minimal custom.d.ts + tsconfig types entry to keep tsc clean.

Testing

• npm ci && npm run build — Docusaurus SUCCESS for both en and zh-Hans locales (the zh-Hans broken-anchor warnings pre-exist on main)
• npx tsc --noEmit -p tsconfig.json — clean

🤖 Generated with Claude Code