chore(deps): take the weekly production updates, zod held on 4.4

Next 16.4.0, pg-boss 12.37.1, the AWS SDK 3.1146, @napi-rs/canvas 1.0.10,
@node-rs/argon2 2.2.2, @simplewebauthn/server 14.0.3, TanStack Query and
Virtual, lucide-react, mmdb-lib, nodemailer, otpauth, pg, radix-ui,
react-day-picker, react-hook-form, tailwind-merge and yaml.

pg-boss moves its schema from 42 to 45 (three additive migrations, nullable
columns and one partial index, no table rewrite); the worker applies them on
start as before. The retention test pins the installed version, so it moves
to 12.37.1 after re-checking every source line it asserts.

zod stays on 4.4.3. 4.5 requires seconds in `z.iso.datetime()` and 4.6
rewrites nullable unions in the generated JSON Schema into `type` arrays,
which reshapes the OpenAPI document and the MCP tool schemas. Dependabot
skips zod 4.5 and later until that move is made on purpose.

.github/dependabot.yml

@@ -23,6 +23,18 @@ updates:
         update-types:
           - "patch"
           - "minor"
+    ignore:
+      # zod 4.5 made `z.iso.datetime()` require seconds, so a request carrying
+      # `2026-01-01T06:15Z` that passes today would be refused with a 422 on
+      # every route that validates a timestamp, and 4.6 rewrites nullable and
+      # primitive unions in the generated JSON Schema from `anyOf` to `type`
+      # arrays, which reshapes the OpenAPI document and every MCP tool schema.
+      # Both are contract changes for the web client, the iOS app and MCP
+      # callers, not a routine bump, so the move past 4.4 gets its own change
+      # with the timestamp producers audited. Patch releases on 4.4 still
+      # arrive.
+      - dependency-name: "zod"
+        versions: [">=4.5.0"]
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule: