fix(deps): override postcss and sharp — the last two advisories in the image

[0xmanhnv]

Why now

ui#344 found these and deliberately left them:

Both are build-time or unreachable today. […] Clearing them needs overrides,
and it swaps Next's internal CSS pipeline, so it needs its own change with its
own build check.

They are now the only thing left. After ui#349 removed npm from the runtime
image, a Trivy scan of the built production image reports exactly these three
alerts — postcss ×2, sharp ×1 — and they are what keeps the Trivy check red on
the v0.4.0 release PR.

With these overrides the image reports 0 HIGH/CRITICAL.

Neither is fixable by a version bump: Next 16.2.12 pins postcss to 8.4.31
exactly and declares sharp: ^0.34.5. overrides is the only mechanism.

postcss 8.4.31 → 8.5.25

Applied tree-wide, including the copy nested under next:

$ python3 -c "... [k for k,v in packages if k.endswith('/postcss') and v.version.startswith('8.4')]"
none — override took

The risk was real: this rebuilds every stylesheet through a different postcss.
It does not change a byte. The largest emitted stylesheet has the same
content hash in the override build and the develop build —

0u2h44mgsyx9m.css   250,989 bytes   md5 c7a459c459e745be8b4ff6dddba21382   (both)
$ cmp -s "$override" "$develop" && echo identical
identical

— with 41 --background/--foreground token references and 476 dark-mode
selectors intact. Next generates the CSS filename from a content hash, so
identical names across two independent builds is about as direct as this
evidence gets.

sharp 0.34.5 → 0.35.3

A major (libvips 8.17 → 8.18), and nothing calls it: no images: block in
next.config.ts, next/image imported in zero files, /public holds five
SVGs which bypass sharp entirely.

Upgraded pre-emptively anyway, because it is the single item that would become
reachable the moment someone adds one images.remotePatterns entry — and at
that point nobody rereads a months-old triage note. Being unreachable by
configuration is not the same as being safe.

Verified

Check	Result
Trivy HIGH/CRITICAL on the built production image	0 (was 6 before ui#349, 1 after)
emitted CSS vs develop build	byte-identical, same content hash
npm ci	clean
tsc --noEmit	exit 0
vitest run	866 tests / 50 files, pass
npm run build	compiled successfully