chore(release): v1.18.1

Maintenance patch clearing two transitive security advisories. Bump the
package version, record the changelog entry, and regenerate the OpenAPI
version line. No functional changes.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "healthlog",
-  "version": "1.18.0",
+  "version": "1.18.1",
   "description": "Self-hosted personal-health-tracking PWA with Withings integration, AI insights, and doctor-report PDF export.",
   "license": "PolyForm-Noncommercial-1.0.0",
   "homepage": "https://healthlog.dev",