fix(deps): update all non-major dependencies - #86

All three locked installs succeeded, the site build and CI JavaScript syntax checks passed, and the reviewed package changes do not break the APIs used here.

Refreshes the root UI and router packages, plus the dotenv and Nodemailer lockfile resolutions. The Pink stylesheet and icon packages are also moved to 0.26.0, and xss and related transitive packages are updated.