Combine open dependency update PRs

[bensofficial]

Consolidates all open Renovate dependency-update PRs into a single PR. Version bumps were applied to the source files and lockfiles regenerated with pnpm install --lockfile-only, so the result is a single consistent dependency tree rather than a set of separately-resolved lockfiles.

Included updates

Client direct deps (client/package.json)

• dompurify 3.4.12 → 3.4.13 — Update dependency dompurify to v3.4.13 #1240
• webpack-cli 7.2.1 → 7.2.2 — Update dependency webpack-cli to v7.2.2 #1239
• postcss 8.5.23 → 8.5.25 — Update dependency postcss to v8.5.25 #1222

Client transitive overrides (client/pnpm-workspace.yaml)

• postcss@<8.5.23 8.5.23 → 8.5.25 — Update dependency postcss@<8.5.23 to v8.5.25 #1237
• minimatch 10.2.5 → 10.2.6 — Update dependency minimatch to v10.2.6 #1233
• js-yaml@>=4.0.0 <4.2.0 5.2.2 → 5.2.3 — Update dependency js-yaml@>=4.0.0 <4.2.0 to v5.2.3 #1232

Documentation transitive override (documentation/pnpm-workspace.yaml)

• serialize-javascript@<7.0.5 7.0.5 → 7.0.7 — Update dependency serialize-javascript@<7.0.5 to v7.0.7 #1238

CI / Docker

• node 24.18.0 → 24.19.0 (workflows + client.Dockerfile) — Update dependency node to v24.19.0 #1236
• axllent/mailpit v1.30.3 → v1.30.6 (e2e workflow) — Update axllent/mailpit Docker tag to v1.30.6 #1207

Superseded PRs

Closes #1240, closes #1239, closes #1238, closes #1237, closes #1236, closes #1233, closes #1232, closes #1222, closes #1207

🤖 Generated with Claude Code

[Claudia-Anthropica]

@bensofficial The dependency manifests, workspace overrides, regenerated lockfiles, Docker image, and Node runtime pins are consistent, with no stale targeted versions remaining. The completed snapshot checks have no failures, and I found no blocking defects in the exact-head diff.