deps: tighten postcss pnpm override from `>=8.5.10` to `^8.5.10`

[harshitsinghbhandari]

Follow-up to #58 (review nitpick — deferred to save CI minutes).

Context

PR #58 added a pnpm override to close CVE-2026-41305 (postcss <8.5.10):

```json
"pnpm": {
"overrides": {
"postcss@<8.5.10": ">=8.5.10"
}
}
```

A reviewer flagged that the RHS `>=8.5.10` is open-ended: if a future postcss 9.x ships and any transitive consumer requests it on a lockfile refresh, pnpm could silently pick the new major and break the build with no obvious cause.

Proposed change

Tighten to `^8.5.10` so the major stays pinned to 8:

```diff
"pnpm": {
"overrides": {

• "postcss@<8.5.10": ">=8.5.10"

• "postcss@<8.5.10": "^8.5.10"
  }
  }
  ```

Why this wasn't done in #58

Pure preventative hygiene — no postcss 9.x exists in the tree today (`pnpm why postcss` shows 8.5.15 across next 16.2.6, @tailwindcss/postcss 4.3.0, and vite 8). The risk is layered (postcss 9 must ship, a consumer must ask for it, pnpm must pick it) and the CI cost (~10 min, depleting quota) outweighed the immediate benefit. Deferred to a follow-up so it can bundle with the next necessary push.

Acceptance

• Override RHS reads `^8.5.10`
• `pnpm install` regenerates lockfile cleanly
• `pnpm audit --prod` still reports `1 moderate (1 ignored)` (the documented uuid finding from security: M17 + L1 + L2 + L12 pre-launch follow-ups #58)
• `pnpm build` succeeds

Out of scope

The uuid (L2) audit-ignore from #58 stays — that's tied to the planned `next-auth@5` migration, tracked separately.