bump brace-expansion + postcss to clear npm advisories (Dependabot alerts #504, #509)

[juanresendiz813]

Clears two HIGH npm Dependabot alerts on the SvelteKit UI (saiku-ui/), both transitive dependencies resolved via npm audit fix (no --force, no package.json change):

• Dependabot alert Captions and format not used in DrillDown #504 — brace-expansion (DoS advisories GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg). Pulled in transitively via eslint > minimatch > brace-expansion. Bumped 5.0.6 -> 5.0.8 (fixed in 5.0.7).
• Dependabot alert Exception during webapp reload #509 — postcss (path-traversal in source-map auto-loading, GHSA-r28c-9q8g-f849). Pulled in transitively via vite and eslint-plugin-svelte. Bumped 8.5.14 -> 8.5.24 (fixed in 8.5.18).

Both are patch-level bumps that already sit inside the existing semver ranges, so only package-lock.json changed. A third transitive, nanoid (a postcss dependency), moved 3.3.12 -> 3.3.16 as part of the same postcss subtree — harmless patch bump, no direct-dep or override involvement.

Verification (run on Node 24 locally; CI baseline is Node 20)

• npm audit -> 0 vulnerabilities
• npm ls brace-expansion postcss -> only brace-expansion@5.0.8 and postcss@8.5.24
• npm ci -> clean (added 396 packages)
• npm run build -> pass (full prod build: build:app + build:embed + build:embed-npm + build:embed-react-npm) — this is the CI ui job never runs npm run build — a broken production frontend build passes green #1551 gate
• npm run check -> 0 errors (2 pre-existing unrelated warnings)

No overrides were needed. No parent packages were force-bumped.