chore(deps): clear the seventeen scanner findings

Trivy flags twelve distinct advisories on the lockfile and the image, none
in this code: next 16.2.11 (two critical, fixed in 16.3.3), sharp 0.35.3
pulled by next (high), nodemailer 9.0.3 (one high, three medium), js-yaml
4.3.1 (high), hono 4.13.3 under the MCP SDK's node server (three medium),
and the vitest mocker and baseline-browser-mapping (medium). Dependabot
lists none of them, which is why they sat.

next moves to 16.3.4 and nodemailer to 9.1.1 as direct pins; vitest to
4.1.11. js-yaml, hono, baseline-browser-mapping and sharp are transitive
and move through pnpm overrides bounded to the vulnerable ranges, so the
copies the scanner names change and nothing else does. Typecheck, lint,
the unit suite and the production build pass locally; the release gate
runs the integration and end-to-end suites on the minor Next bump.

package.json

@@ -80,9 +80,9 @@
     "jspdf-autotable": "^5.0.8",
     "lucide-react": "^1.34.0",
     "mmdb-lib": "^3.0.2",
-    "next": "16.2.11",
+    "next": "16.3.4",
     "next-themes": "^0.4.6",
-    "nodemailer": "9.0.3",
+    "nodemailer": "9.1.1",
     "otpauth": "^9.5.1",
     "p-limit": "^7.3.1",
     "pg": "^8.23.0",
@@ -135,6 +135,6 @@
     "testcontainers": "^12.1.0",
     "tw-animate-css": "^1.4.0",
     "typescript": "^6",
-    "vitest": "^4.1.5"
+    "vitest": "^4.1.11"
   }
 }