fix(deps): update dependency katex to ^0.18.5

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
katex (source)	^0.18.1 → ^0.18.5

---

Release Notes

KaTeX/KaTeX (katex)

v0.18.5

Compare Source

Bug Fixes

• char: accept U+10FFFF (#​4265) (6805538), closes #​2549

v0.18.4

Compare Source

Bug Fixes

• environment: report invalid environment names as ParseError (#​4256) (e507f75), closes #​3760 #​3760

v0.18.3

Compare Source

Bug Fixes

• allow braced arguments for delimsizing (#​4255) (1c973ae)

v0.18.2

Compare Source

Bug Fixes

• prevent prototype pollution in settings (#​4260) (0adf7e7)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[pikachuren]

结论：改动本身没问题，等冷静期过后重跑 CI 即可合并

katex 0.18.1 → 0.18.5 是 patch 级升级，Build Check 的失败与代码无关，是供应链策略拦截：

✗ Lockfile failed supply-chain policy check (737 entries in 6.1s)
[ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION] 1 lockfile entries failed verification:
  katex@0.18.5 was published at 2026-08-31T16:46:25.482Z,
  within the minimumReleaseAge cutoff (2026-08-30T18:12:58.343Z)

也就是 CI 跑的时候 0.18.5 才发布不到两小时，被仓库设置的最短发布年龄门槛挡下。这个策略是防投毒的正常防线，不建议为单个 PR 放宽。按发布时间推算目前该版本已满足 24 小时门槛，重跑一次 Build Check 应该就能通过。

lockfile 中除 katex 自身外新增了 commander@15.0.0（katex 的 CLI 依赖），属于预期内的传递依赖变化。

CI 转绿后请顺带确认一下 Markdown 预览中的公式渲染正常。这里有个容易被忽略的点：vite.config.ts 通过 vite-plugin-static-copy 把 node_modules/katex/dist/katex.min.css 和 dist/fonts/* 复制到 static/katex，所以版本变化时样式和字体文件是跟着一起换的，建议实际看一眼公式和特殊符号的显示效果，而不只是看构建是否成功。