Update vulnerable Markdown rendering dependencies

[PathGao]

Fixes #305

Updates Mermaid from 11.12.2 to 11.16.0 and pins DOMPurify at 3.4.12. The npm override applies that patched DOMPurify release to Monaco’s nested copy as well, so the resolved production tree has no audit findings.

The lockfile root version is also synchronized with package.json at 2.6.14.

Depends on #304. Merge order: #286 → #287 → #288 → #293 → #296 → #298 → #300 → #301 → #302 → #304 → this PR.

Validated with npm ci, npm run check, npm test (135 tests), npm run build, npm audit --omit=dev (0 vulnerabilities), and cargo test (21 Rust tests).

[PathGao]

@alecdotdev This is the next chain item after #304. It removes the current production dependency audit findings without moving Monaco, because the available Monaco update changes its package export surface and breaks the maintained monaco-vim integration.

The PR pins the patched DOMPurify release, applies it to the nested Monaco dependency through npm overrides, and updates Mermaid. The production audit is clean and the full build passes. Please merge after #304.