Bump nanoid past the zero-size loop advisory

`npm ci` in the UI started reporting one high-severity vulnerability:
GHSA-2v37-7h3g-55p8, a custom generator called with size 0 spinning
forever. Lockfile-only bump, 3.3.17 -> 3.3.18.

Worth recording that this was never urgent. nanoid arrives as
vite -> postcss, marked `"dev": true`, so it is build tooling and never
reaches dist/. Postcss calls it with a fixed size for source-map ids,
which is not the vulnerable path. npm audit scores the package in
isolation, not the way this project calls it.

`npm run build` still produces the same bundle.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ui/package-lock.json

@@ -1465,9 +1465,9 @@
       "license": "MIT"
     },
     "node_modules/nanoid": {
-      "version": "3.3.17",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.17.tgz",
-      "integrity": "sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==",
+      "version": "3.3.18",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz",
+      "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==",
       "dev": true,
       "funding": [
         {