fix(sec): bump nanoid 3.x to 3.3.18

[mrxmoex]

Summary

• Bump nanoid@^3 (root override) and the website unscoped pin from 3.3.17 to 3.3.18 for GHSA-2v37-7h3g-55p8 / CVE-2026-67213.
• GitHub's reviewed advisory floors 3.x at 3.3.18, not 3.3.17. 3.3.17 fixed the sync loop and missed async/index.native.js.
• Website pin is included so website/ npm audit clears (this is the gap in fix(deps): pin nanoid@^3 override to patched 3.3.18 (GHSA-2v37-7h3g-55p8) #86053).
• No Electron change. Chromium 144 → 150 stays on fix: bump Electron to 43.4.1 and nanoid to 3.3.18 #92543.

Split from #92543 so the audit pin can land without a desktop runtime jump.

Related Issue

Split from #92543. Does not close #92543.

Type of Change

• 🔒 Security fix

Test plan

• npm audit root / web / ui-tui / website → nanoid 3.3.17 gone
• Lockfiles contain nanoid-3.3.18.tgz and no nanoid-3.3.17.tgz
• Integrity sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==

Risk

Low. Transitive pin (vite / sanitize-html / postcss). No app-code call to customAlphabet with attacker size. Override currently forces 3.3.17, so audit cannot climb without this.

[alt-glitch]

This was generated by AI during triage.

Duplicate of #89335 — it makes the same root and website nanoid 3.3.18 remediation.