fix(deps): update next to 16.4.2 and nodemailer to 10.1.7

Next 16.4.2 carries the fixes for GHSA-673q-mjm6-r5xr and
GHSA-2464-fhr4-w9xw (unauthenticated remote code execution) and
GHSA-p3m5-59mp-jv5r (denial of service through Server Actions).
eslint-config-next and @next/bundle-analyzer move with it, both pinned
exactly. nodemailer 10.1.7 fixes the address-parser advisories.

The 16.4.0 ignore in the Dependabot config is gone: the history journeys
it was guarding pass on 16.4.2 with the day-step fix, and the note says
what was measured.

.github/dependabot.yml

@@ -14,9 +14,10 @@ updates:
       # single bumps: patch and minor updates travel together and pass the
       # same checks once. Majors stay single so each gets its own review.
       #
-      # The Next.js line travels alone: while a 16.4 patch is still being
-      # re-measured, a red Next bump inside the group holds every harmless
-      # update in it red as well.
+      # The Next.js line travels alone. Its bumps are the ones that move
+      # URL state after history traversal (see the note on 16.4 below), and a
+      # red Next bump inside the group would hold every harmless update in
+      # it red as well.
       production-weekly:
         dependency-type: "production"
         update-types:
@@ -32,19 +33,15 @@ updates:
         exclude-patterns:
           - "eslint-config-next"
           - "@next/bundle-analyzer"
-    ignore:
-      # Next 16.4.0 breaks URL state after history traversal: with a sheet
-      # opened through `?doc=`, Back leaves it open, and `[` / `]` sometimes
-      # do not move `?day=`. Reproduced in three end-to-end journeys (3 of 40
-      # repeated runs on 16.4.0, 0 of 80 on 16.3.8 with everything else
-      # equal). 16.3.8 carries every published security fix, so the line
-      # waits for a 16.4 patch; the two packages that move with it wait too.
-      - dependency-name: "next"
-        versions: ["16.4.0"]
-      - dependency-name: "eslint-config-next"
-        versions: ["16.4.0"]
-      - dependency-name: "@next/bundle-analyzer"
-        versions: ["16.4.0"]
+    # No ignore for the Next.js line any more. 16.4.0 lost URL state after
+    # history traversal: with a sheet opened through `?doc=`, Back left it
+    # open, and `[` / `]` sometimes did not move `?day=` (3 of 40 repeated
+    # runs of three end-to-end journeys, 0 of 80 on 16.3.8). Measured on
+    # 16.4.2: the `?doc=` and dashboard journeys passed 80 of 80, the day keys
+    # still lost a step in 2 of 20, because a step started from the day the
+    # layer had last rendered and 16.4 lets that trail the URL. A step now
+    # starts from the URL itself; after that the three journeys passed 200 of
+    # 200 repeated runs and the day keys alone another 80 of 80.
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule: