Website lockfile resolves newly disclosed vulnerable dependencies

## Summary

The website lockfile currently resolves 16 vulnerable package families. A fresh `pnpm audit --json` reports 86 vulnerable dependency instances: 18 high, 59 moderate, and 9 low.

This includes the reviewed lodash advisory CVE-2026-4800 / GHSA-r5fr-rjxr-66jc through `mermaid -> @mermaid-js/parser -> langium -> chevrotain -> lodash-es`.

## Reproduction

```bash
cd website
pnpm install --frozen-lockfile
pnpm audit --json
```

Current `main` exits with code 1.

## Proposed fix

- Upgrade the direct Mermaid dependency from 11.12.2 to 11.17.2.
- Refresh the lockfile within the existing direct dependency ranges so transitive packages resolve to patched releases.
- Do not add broad overrides.

The candidate patch resolves the audit to 0 critical/high/moderate/low findings.

## Validation

- `pnpm install --frozen-lockfile`
- `pnpm audit --json` (0 findings)
- `pnpm exec tsc -b --noEmit`
- `pnpm run build`

Note: the repository-wide website `format:check` currently reports pre-existing Prettier differences across 272 files, so the patch formats only the generated lockfile and does not rewrite unrelated files.