v3.6.2 -- Lockfile portability fix (supersedes v3.6.1)

Release v3.6.2 -- Lockfile portability fix (supersedes v3.6.1)

Release-engineering follow-up to v3.6.1. No code or dependency changes.

What this release fixes

The 3.6.1 lockfile bump for postcss was performed on a workstation
whose ~/.npmrc pointed at an internal Artifactory mirror, so npm
recorded https://artifactory.twitter.biz/.../postcss-8.5.12.tgz as
the resolved URL in frontend/package-lock.json. Hosts without
access to that mirror -- which is most of them -- failed npm install
against the v3.6.1 lockfile with HTTP 403 Forbidden.

The lockfile has been re-resolved against the public registry
(https://registry.npmjs.org/) so deploys from a clean clone of the
v3.6.2 tag work everywhere.

Operator notes

• Hosts already running 3.6.1 successfully (deployed by rsync of a
  working tree, not from the tagged ref) need no special action --
  routine upgrade to 3.6.2 just re-resolves the same postcss 8.5.12
  package from a public URL.
• For clean-clone or fresh-install deploys, prefer v3.6.2 over v3.6.1.
  v3.6.1 is otherwise identical and remains in the changelog as
  history.
• No new CVE patches in this release -- both Dependabot fixes from
  3.6.1 (postcss XSS, python-multipart DoS) are intact in 3.6.2.