[rennf93]

Closes #172

npm audit in docs/ now reports found 0 vulnerabilities (55 open Dependabot alerts before), and the site builds the same 239 pages.

This folds the 12 Dependabot PRs #157, #158, #160 to #169 into one, because they all rewrite docs/package-lock.json and #161 alone breaks the build. I'll close them as superseded once this lands.

Changes, all under docs/:

1. package.json and package-lock.json: astro 6.1.1 to 7.4.1, @astrojs/starlight 0.38.2 to 0.42.6, sharp 0.34.5 to 0.35.5 (the build(deps): bump sharp, @astrojs/starlight and astro in /docs #161 lock as the base), plus starlight-typedoc 0.21.5 to 0.23.1 (its peer range for Starlight 0.39+). The transitive fixes of the other 11 PRs come with it (defu 6.1.7, markdown-it 14.3.3, brace-expansion 5.0.12, postcss 8.5.31, js-yaml 4.3.2, devalue 6.0.3, smol-toml 1.9.1, svgo 4.1.0, nanoid 3.3.20, source-map-js 1.2.2).
2. astro.config.mjs: the Reference group moves to the shape Starlight 0.39 requires, items: [{ autogenerate: { directory: 'reference' } }]. Without it astro build fails with Found an autogenerate object with a label. Support for autogenerated sidebar groups was removed in Starlight v0.39.0.
3. package.json overrides: postcss-nested ^7.0.2. @expressive-code/core 0.44.2 (latest) still asks for postcss-nested ^6.0.1, which pins postcss-selector-parser 6.1.5 (GHSA-rj75-hqrm-r3gf, fixed only in 7.1.6). postcss-nested 7.0 changes comment placement and drops Node 16 and older, nothing else.

Verified locally (Node 24, pnpm build at the root first, as docs.yml does):

• npm ci then npx astro build: 239 pages, the same 239 paths as master's build. On a content page the only link differences are the CSS bundle names.
• I built with and without the postcss-nested override: the two dist/ trees are byte-identical.
• npm audit: found 0 vulnerabilities.

Not in this PR: astro build regenerates the committed API pages under docs/src/content/docs/api/ (they are stale against master), and I left them out to keep the change to dependencies.