fix: clear nightly CI audit failure (nanoid 3.3.18) and group Dependabot updates — 3.1.1

[VibhavSetlur]

Why

The nightly scheduled CI run (.github/workflows/ci.yml, cron 0 6 * * *) has failed
every night. The only failing step is step 9,
Audit production dependencies (high/critical) —
npm audit --omit=dev --audit-level=high. Lint, type-check, unit tests and build
all pass. The same scheduled run fails on ModelSEED/ModelSEED-UI itself, so this is
not fork drift — the fork's master and staging are byte-identical to upstream.

On staging the audit reported exactly one high advisory:
nanoid 3.3.17 — GHSA-2v37-7h3g-55p8. nanoid is a production transitive of
postcss (range ^3.3.16), so 3.3.18 satisfies it as a lockfile-only change.

What changed

• fix(deps) — package-lock.json: nanoid 3.3.17 → 3.3.18, closing
  GHSA-2v37-7h3g-55p8. No package.json dependency ranges were touched.
• chore(deps) — .github/dependabot.yml: routine npm version updates are now
  grouped into one production and one development PR, weekly, limit 5
  (previously: daily, ungrouped, limit 10 — which is what produces the flood of
  one-PR-per-package). Dependabot security updates are generated independently
  of version-update groups and are not suppressed by grouping; they continue to
  open individually and promptly.
• fix(release) — 3.1.0 → 3.1.1 across VERSION.md, package.json and the
  package-lock.json root version fields, plus a dated [3.1.1] CHANGELOG.md
  section, per CONTRIBUTING.md (fix-only commit set → patch bump).

What deliberately did not change

• .github/workflows/ci.yml is untouched — the high/critical audit gate and the
  nightly schedule both stay exactly as they are. Nothing was muted or weakened.
• No application, API or UI source. No broad dependency upgrades.

Verification (conda env modelseed-ui, mirrors CI)

command	result
npm ci	exit 0
npm audit --omit=dev --audit-level=high	exit 0 — found 0 vulnerabilities ({info:0, low:0, moderate:0, high:0, critical:0})
npm run lint	exit 0 (16 pre-existing warnings)
npx tsc --noEmit	exit 0
npm run test:run	exit 0
npm run build	exit 0

Note for master

master (v3.0.0, e61279c) still carries four high advisories — next 16.2.6,
postcss 8.5.12, sharp 0.34.5 and nanoid 3.3.11 — which is why the nightly run
on master is red. staging already carries next 16.3.0 / postcss 8.5.25 /
sharp 0.35.3, so once this lands and staging is merged to master, all four
clear. This PR intentionally does not edit dependencies on master.

[VibhavSetlur]

Superseded by #230 — same change, byte-identical diff, but on a dedicated head branch (VibhavSetlur:fix/ci-audit-and-dependabot-noise) instead of VibhavSetlur:staging.

Reason: this PR's head was my staging branch, so pushing any further work to it would have silently absorbed unrelated commits into this security fix. #230 keeps the nanoid/Dependabot/3.1.1 work isolated and independently mergeable, ahead of a separate Solr-upgrade PR. Nothing is lost: git diff between the two heads is empty.

Please review and merge #230 instead.