chore(deps): coordinated @tiptap/* bump to close GHSA-cp6q-959q-f8rh

Change Request — dependency fix needing a real code change (patch duty 2026-09-09).

Problem

@tiptap/core and its ~35-package extension family are on 3.22.4–3.30.3 and carry GHSA-cp6q-959q-f8rh (medium — mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes). It was not fixable in the lockfile-only patch-duty PR (#157) because:

• The fix needs @tiptap/core ≥ 3.30.4 and @tiptap/extension-code-block-lowlight at 3.31.3, which npm audit flags as a breaking change.
• The whole @tiptap/* set versions together, so this is a coordinated ~35-package bump that must be verified against the block editor UI, not force-pinned via overrides.

Ask

Bump the full @tiptap/* family to the patched line (≥3.30.4 core / 3.31.3 lowlight), then verify the editor renders + behaves (marks, lists, tables, code blocks, images) before merge.

Not in scope of this issue

image-size (high) — no upstream fix exists yet; tracked as accepted until a patched release ships.

Found during weekly patch duty. Docs PR: #157.