fix(deps): patch known CVEs in Next.js and transitive dependencies

[keysersoft]

Patches the known CVEs flagged by CodeQL/Trivy that we can fix without breaking changes. No application code touched — only packages/frontend/package.json (one line) and the lockfile.

Resolved

Package	Before → After	Advisories
next	16.2.10 → 16.2.12	4 HIGH — SSRF in Server Actions on custom servers (CVE-2026-64649), SSRF in rewrites via attacker-controlled destination host (CVE-2026-64645), middleware/proxy bypass with Turbopack + single locale (CVE-2026-64642), DoS in App Router Server Actions (CVE-2026-64641) · 4 MEDIUM (cache confusion ×2, unbounded Edge Server Action payload, image-optimization DoS via SVG, internal Server Function endpoint disclosure)
brace-expansion	1.1.14/5.0.6 → 1.1.16 / 2.1.2 / 5.0.8	2 HIGH — OOM via unbounded expansion (CVE-2026-14257), exponential-time expansion (CVE-2026-13149)
fast-uri	3.1.2 → 3.1.4	2 HIGH — CVE-2026-16221, security-policy bypass via improper Unicode hostname canonicalisation (CVE-2026-13676)
hono	4.12.18 → 4.12.32	3 MEDIUM — JSX cross-request context leak, XSS via JSX escaping bypass in cx(), header de-duplication dropping values
protobufjs	7.5.7 → 7.6.5	MEDIUM — DoS via crafted .proto schema
body-parser	2.2.2 → 2.3.0	LOW — DoS via invalid limit option

Everything except next was reachable simply by refreshing within the ranges the tree already declared (npm update), so the diff stays small.

Deliberately deferred (with reasons)

These are all exact pins held by upstream packages, so fixing them means either forcing a version our dependencies aren't tested against, or a major bump:

Package	Why not now
postcss 8.4.31 / 8.5.15 (HIGH)	Pinned exactly by next and the Tailwind PostCSS plugin. Build-time only, processing our own CSS — the advisory requires attacker-controlled sourceMappingURL input.
js-yaml 5.2.1 (HIGH)	Pinned exactly by @nestjs/swagger, and its latest release (11.4.6) still pins 5.2.1 — there is no upstream fix to take. Used to serve our own OpenAPI document, not to parse untrusted YAML.
sharp 0.34.5 (HIGH)	Sits inside next's ^0.34.5 range; jumping to 0.35 diverges from the version Next is tested against.
@hono/node-server 1.19.x (MEDIUM)	Fix is a major (2.0.5). The advisory is a Windows-only serve-static path traversal; we ship Linux containers and don't use serve-static.
valibot 1.2.0, Jaeger OTel propagator 2.8.0	Exact pins reached only through dev-only paths.

Finding worth a follow-up

While attempting to force the pins above I found that the root package.json overrides block is not being honoured in this workspace — the pre-existing rxjs: 7.8.1 pin is also ineffective (7.8.2 is still installed), and the lockfile records no overrides at all. Forcing the remaining pins would therefore require regenerating the whole lockfile, which is too broad for a security patch. I'd rather fix the overrides mechanism in its own PR — happy to open an issue.

Verification

• Backend: tsc clean, 3460 tests green
• Frontend: tsc clean, next build clean on 16.2.12