fix: upgrade postcss 8.5.20 → 8.5.23 (GHSA-6g55-p6wh-862q)

Arbitrary .map file read via untrusted sourceMappingURL when from is
unset. Added npm overrides to force postcss@8.5.23 across all transitive
deps (tsup, vitest→vite).

fe-app-tachyon/package-lock.json

@@ -3725,9 +3725,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.20",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.20.tgz",
-      "integrity": "sha512-lW616l85ucIQL+FocMmL7pQFPqBmwejrCMg+iPxyImlrANNJG9NHq/RkyCZopDhd8C3LA03PHRJDjkbGu8vvug==",
+      "version": "8.5.23",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.23.tgz",
+      "integrity": "sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==",
       "dev": true,
       "funding": [
         {

fe-app-tachyon/package.json

@@ -35,5 +35,8 @@
     "typescript": "5.9.3",
     "typescript-eslint": "8.45.0",
     "vitest": "^4.1.10"
+  },
+  "overrides": {
+    "postcss": "8.5.23"
   }
 }