chore(deps): bump docs deps to latest (astro 7.1.6, marked 18.0.7, sharp 0.35.3) (#203)

Bumps the two direct `docs/` dependencies to their latest releases and
regenerates the lockfile, pulling transitive deps forward.

| Package | From | To |
|---------|------|-----|
| astro | 7.1.1 | **7.1.6** |
| marked | 18.0.3 | **18.0.7** |
| sharp (transitive) | 0.34.5 | **0.35.3** |

### Why sharp matters
sharp 0.34.5 carries a **high-severity** libvips advisory —
[GHSA-f88m-g3jw-g9cj](GHSA-f88m-g3jw-g9cj)
(CVE-2026-33327 / 33328 / 35590 / 35591). Bumping astro alone did not
pull sharp forward, so `npm audit fix` was used to force 0.35.3. `npm
audit` now reports **0 vulnerabilities**.

### Supersedes
Consolidates the Dependabot updates that were auto-closed as "updatable
in another way" after the lockfile shifted:
- #197 (sharp + astro)
- #192 (esbuild + astro) — the esbuild 0.28.1 security fix already
landed transitively via #202.

The postcss (#201), astro→7.1.1 (#202), svgo (#194), and vite bumps
already merged / resolved on main.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Roger-luo