fix: tighten lodash resolution to ^4.18.1 (CVE-2026-4800)

[Copilot]

Lodash < 4.18.0 is vulnerable to code injection via the _.template imports key (CVE-2026-4800 / GHSA-r5fr-rjxr-66jc). The previous resolution ^4.18.0 was imprecise; this tightens it to ^4.18.1.

Changes

• package.json — resolutions.lodash: ^4.18.0 → ^4.18.1
• yarn.lock — regenerated; all lodash specifiers (^4.17.15, ^4.17.21, ~4.17.21) now pin to 4.18.1

Original prompt

Fix CVE-2026-4800 (GHSA-r5fr-rjxr-66jc): lodash code injection via _.template imports key, patched in 4.18.0.

Close PR #281 (lodash 4.17.23 is still vulnerable). Add "lodash": "^4.18.1" to the resolutions block in the root package.json (lodash is a transitive dep, so a resolution is correct). Run yarn install / npm install, commit the updated lockfile. Verify no version below 4.18.0 remains with yarn why lodash or npm ls lodash.