chore(deps): bump marked from ^4.1.0 to ^15.0.12

Skips 11 major versions. Our usage (marked.parse(str, {gfm, breaks}))
is compatible — gfm and breaks options remain supported, parse() is
still synchronous without async extensions. All 870 unit tests pass.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: 2 people

web-src/package-lock.json

@@ -9,7 +9,7 @@
     "core-js": "^3.25.3",
     "dompurify": "^3.4.9",
     "lodash": "^4.18.1",
-    "marked": "^4.1.0",
+    "marked": "^15.0.12",
     "material-design-icons": "^3.0.1",
     "pinia": "^3.0.4",
     "tinycolor2": "^1.4.2",