fix(deps): update postcss to 8.5.23, accept the react-router advisory

npm update postcss moves it 8.5.13 -> 8.5.23, clearing GHSA-r28c-9q8g-f849
(path traversal in previous-source-map auto-loading via a sourceMappingURL
comment, arbitrary .map disclosure, 7.5 high). No overrides entry needed,
unlike #241: vite declares postcss ^8.5.3 and 8.5.23 is published, so the
existing range already permitted the fix and only the lockfile carried a
stale resolution. nanoid 3.3.11 -> 3.3.16 comes along as postcss's own
dependency, within its declared range.

postcss IS the CSS pipeline, so a green build only proves compilation. The
emitted stylesheet was diffed across the bump and is byte-for-byte identical
(same content hash, same asset filename).

The remaining react-router advisory (GHSA-qwww-vcr4-c8h2, RSC Mode CSRF
bypass) is accepted rather than fixed. It targets React Server Components,
which a Tauri desktop app never runs — App.tsx mounts a client-only
BrowserRouter and src/ has no createStaticHandler, StaticRouter or server
rendering. There is also nothing to move forward to: react-router-dom is
frozen at 7.18.1 since v8 merged the package into react-router, so npm's
proposed "fix" is a downgrade to 7.11.0, and leaving the affected range
means migrating to react-router v8. Re-evaluation trigger tracked in #317.

Unlike the Rust side, no CI gate is involved: check-frontend.yml runs no
npm audit step, so nothing turns red. That expectation is now written down
in docs/architecture.md and CLAUDE.md so the two permanent high findings do
not read as a regression.

npm audit: 3 findings -> 2 (high 3 -> 2), postcss cleared.
npm ci + npm run build + 871 vitest green.

Resolves #311

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.forgejo/workflows/check-rust.yml

@@ -86,12 +86,18 @@ jobs:
       #
       # CRATES must mirror the crates named in .cargo/audit.toml. Adding an
       # entry there without adding its crate here leaves it unguarded.
+      #
+      # Every check echoes its result, including the passing ones. A guard that
+      # is silent on success cannot be told apart in the log from a guard that
+      # never ran — which is the same silent-skip failure mode this step exists
+      # to catch, one level up.
       - name: Verify suppressed advisories are still unreachable
         run: |
           set -u
           CRATES="quick-xml rsa"
           TARGETS="x86_64-unknown-linux-gnu x86_64-pc-windows-msvc"
           rc=0
+          checks=0
           for crate in $CRATES; do
             for target in $TARGETS; do
               # An absent crate exits 0 with empty stdout ("nothing to print"
@@ -104,9 +110,12 @@ jobs:
                 continue
               }
               if [ -n "$out" ]; then
-                echo "$crate is now compiled for $target — its .cargo/audit.toml suppression is no longer justified (see #310)."
+                echo "FAIL: $crate is now compiled for $target — its .cargo/audit.toml suppression is no longer justified (see #310)."
                 rc=1
+              else
+                echo "ok: $crate absent from $target"
               fi
+              checks=$((checks + 1))
             done
           done
           # Canary: a crate known to be present. If this stops being found, the
@@ -114,9 +123,12 @@ jobs:
           canary=$(cargo tree --manifest-path src-tauri/Cargo.toml --locked \
                      -i tar --target x86_64-unknown-linux-gnu 2>/dev/null) || true
           if [ -z "$canary" ]; then
-            echo "Canary failed: 'tar' was not found although it is a known dependency. The guard is not proving anything."
+            echo "FAIL: canary 'tar' was not found although it is a known dependency. The guard is not proving anything."
             rc=1
+          else
+            echo "ok: canary 'tar' found for x86_64-unknown-linux-gnu"
           fi
+          echo "Suppression guard: $checks checks, exit $rc"
           exit $rc
 
       - name: cargo test