[forzagreen]

Closes the three open Dependabot alerts. All three are build/lint-time dependencies; nothing that ships changes.

• ci: commit the DB dump gzipped #112 source-map-js 1.2.1 → 1.2.2 (high), in backend/frontend via postcss. Lockfile bump only.
• ci: say what the refresh-dump pull request is for #111 / ci: reset the Toolforge checkout to main instead of pulling in deploy-db #113 postcss-selector-parser 6.1.4 → 7.1.6 (medium), in backend/frontend and gadget. Neither parent has a release that accepts v7: tailwindcss@3.4.19 (latest v3) and eslint-plugin-vue@9 (pulled by eslint-config-wikimedia@0.32.6, the latest) both pin ^6. So both package.json get an npm overrides entry. postcss-nested@6.2.0 already asks for ^7.1.6.

Checks:

• npm run build gives a dist/ byte-identical to the build on main, so dist/ is unchanged and needs no commit.
• npm run lint in gadget/ is clean.
• npm audit in gadget/ reports 0 vulnerabilities.

Not fixed: npm audit in backend/frontend still reports braces (GHSA-vfj7-8cjw-p6xm, via tailwind's chokidar/micromatch). No release fixes it (<= 3.0.3 is vulnerable and 3.0.3 is the latest), which is why Dependabot raised no alert. Tailwind 4 drops the chain, but that's a migration of its own.

The overrides can go once Tailwind (or a v4 migration) and eslint-config-wikimedia accept postcss-selector-parser 7.