Update mermaid to clear the lodash-es Dependabot alerts

[willeastcott]

Summary

Lockfile only. This updates mermaid from 12.0.0 to 12.1.0, within @docusaurus/theme-mermaid's >=11.6.0 range. Mermaid 12.1 moves to chevrotain 13, which no longer pins lodash-es to exactly 4.17.23, so lodash-es resolves to 4.18.1. That clears the two lodash-es Dependabot alerts (one high, one medium). The dompurify alert was already fixed by #1259.

Remaining alerts

The other three can't be fixed without package.json overrides until Docusaurus updates its dependencies. Neither package reaches the published site:

• serialize-javascript 6.0.2 (one high, one medium): Docusaurus 3.10 pins copy-webpack-plugin ^11 and css-minimizer-webpack-plugin ^5. They use it at build time only, to serialize our own webpack cache keys.
• uuid 8.3.2 (medium): it comes through webpack-dev-server 5 → sockjs 0.3.24, which hasn't had a release since 2023. It's only used by the local dev server, which uses ws by default and doesn't load sockjs. Even if it did, sockjs only calls uuid.v4() without a buffer, so it never reaches the vulnerable code.

Testing

• npm test (52 pass)
• npm run build succeeds for en and ja with no warnings
• The Mermaid diagram on the Splat Rendering Architecture page renders, with no new console errors
• npm audit now reports only the serialize-javascript and uuid advisories

🤖 Generated with Claude Code