chore(deps): bump transitive mermaid to 11.16.1

streamdown declares mermaid as a hard dependency, so it lands in the
lockfile even though diagram rendering is gated behind the optional
@streamdown/mermaid plugin, which is not installed here. Its declared
range (^11.12.2) already permits 11.16.1, so this was a stale lockfile
pin rather than a range conflict.

Use a scoped override so the floor is re-forced on every install; a
plain lockfile refresh would silently revert.

Author: nicktrn

package.json

@@ -140,6 +140,7 @@
       "brace-expansion@<1.1.13": "1.1.13",
       "brace-expansion@>=2 <2.0.3": "2.0.3",
       "brace-expansion@>=5 <5.0.6": "5.0.6",
+      "mermaid@>=11 <11.16.1": "^11.16.1",
       "@jsonhero/json-infer-types>ip-address": "^10.2.0",
       "@modelcontextprotocol/sdk@>=1.26.0>express-rate-limit": "^8.6.0"
     },