deps: svgo 4.1.0 (CVE-2026-84369, CVE-2026-84370)

Both open Dependabot alerts on the site are svgo removeScripts sanitization bypasses, fixed in 4.1.0. Lockfile bumped; build clean.

Author: ronaldtse

package-lock.json

@@ -36,6 +36,7 @@
     "astro": "^7.0.0",
     "interscript": "^5.2.1",
     "onnxruntime-web": "^1.29.0",
+    "svgo": "^4.1.0",
     "tailwindcss": "^4.0.0",
     "vue": "^3.5.42"
   },