fix(security): override compression in the website to clear GHSA-vc2v-76pw-4v95 (#2096)

The website audit in the Security workflow fails on main: serve pulls
compression 1.8.1, which has a high-severity memory-leak DoS. 1.8.2 is
patched. Dev-only; the exported site never runs it.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: clay-good

website/pnpm-lock.yaml

@@ -22,3 +22,7 @@ overrides:
   # only (transitive via postcss); this is a statically exported site with no server
   # runtime. Remove once transitive nanoid is >=3.3.17 (check: pnpm why nanoid).
   nanoid@<3.3.17: '>=3.3.17 <4'
+  # GHSA-vc2v-76pw-4v95 — compression memory-leak DoS on premature response close.
+  # Dev-only (serve > compression); never in the static site. Remove once
+  # transitive compression is >=1.8.2 (check: pnpm why compression).
+  compression@<1.8.2: '>=1.8.2 <2'