security: clear high-severity alerts (svgo, sharp/libvips) (#18)

svgo -> 4.0.2 (GHSA-2p49-hgcm-8545: removeScripts leaves some
executable scripts intact) via lockfile bump.

sharp -> 0.35.x (GHSA-f88m-g3jw-g9cj: inherited libvips CVEs
CVE-2026-33327/33328, vulnerable < 0.35.0). sharp is transitive via
astro, which still declares ^0.34.0, so pin it with an npm override
instead of forcing an astro major bump (audit wanted astro@7 — a
breaking change for a transitive image-processing dep).

Verified: npm install clean, astro build succeeds (4 pages), 0 high /
0 critical remaining in npm audit.

Author: avifenesh