Merge origin/main (v1.44.2) into fix/v145-sheet-motion

next stays on main's 16.4.2 (the RCE and Server Actions advisories) with its two companions; release's newer dev tools and its own additions are kept. The lockfile is release's, re-resolved. pt-BR, which main does not have, takes the one key main added.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "healthlog",
-  "version": "1.44.0",
+  "version": "1.44.2",
   "description": "Self-hosted personal-health-tracking PWA with Withings integration, AI insights, and doctor-report PDF export.",
   "license": "PolyForm-Noncommercial-1.0.0",
   "homepage": "https://healthlog.dev",
@@ -79,7 +79,7 @@
     "jspdf-autotable": "^5.0.9",
     "lucide-react": "^1.59.0",
     "mmdb-lib": "^3.0.3",
-    "next": "16.3.8",
+    "next": "16.4.2",
     "nodemailer": "10.1.7",
     "otpauth": "^9.5.2",
     "p-limit": "^7.3.3",
@@ -106,7 +106,7 @@
   },
   "devDependencies": {
     "@axe-core/playwright": "^4.14.0",
-    "@next/bundle-analyzer": "^16.3.8",
+    "@next/bundle-analyzer": "16.4.2",
     "@playwright/test": "^1.64.1",
     "@stryker-mutator/core": "10.0.0",
     "@stryker-mutator/vitest-runner": "10.0.0",
@@ -123,7 +123,7 @@
     "@vitest/coverage-v8": "^5.0.5",
     "ajv": "^8.20.0",
     "eslint": "^9",
-    "eslint-config-next": "16.3.8",
+    "eslint-config-next": "16.4.2",
     "fast-check": "4.10.2",
     "knip": "^6.41.0",
     "lefthook": "^2.2.2",