Merge main into develop — sync Dependabot dep bumps before v1.4.20 tag

Brings in 7 dependency PRs auto-merged on main while v1.4.20 was in
flight on develop:
- chore(deps-dev): @tailwindcss/postcss 4.2.4 → 4.3.0 (#156)
- chore(deps-dev): shadcn 4.6.0 → 4.7.0 (#157)
- chore(deps-dev): eslint-config-next 16.2.4 → 16.2.6 (#159)
- chore(deps): zod 4.4.2 → 4.4.3 (#160)
- chore(deps): next 16.2.4 → 16.2.6 (#158)
- chore(deps-dev): tailwindcss 4.2.4 → 4.3.0 (#154)
- chore(deps-dev): @types/node 25.6.0 → 25.6.2 (#153)

Resolves package.json conflict on the F5 metadata block + 1.4.20 bump
and pnpm-lock.yaml.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

package.json

@@ -57,7 +57,7 @@
     "jspdf": "^4.2.1",
     "jspdf-autotable": "^5.0.7",
     "lucide-react": "^1.14.0",
-    "next": "16.2.4",
+    "next": "16.2.6",
     "next-themes": "^0.4.6",
     "pg-boss": "^12.18.2",
     "prisma": "^7.8.0",
@@ -69,7 +69,7 @@
     "sonner": "^2.0.7",
     "tailwind-merge": "^3.5.0",
     "web-push": "^3.6.7",
-    "zod": "^4.4.2",
+    "zod": "^4.4.3",
     "zxcvbn-typescript": "^5.0.1"
   },
   "devDependencies": {
@@ -85,12 +85,12 @@
     "@vitejs/plugin-react": "^5.1.4",
     "@vitest/coverage-v8": "^4.1.5",
     "eslint": "^9",
-    "eslint-config-next": "16.2.4",
+    "eslint-config-next": "16.2.6",
     "pdf-parse": "^2.4.5",
     "pg": "^8.20.0",
     "prettier": "^3.8.3",
     "prettier-plugin-tailwindcss": "^0.8.0",
-    "shadcn": "^4.6.0",
+    "shadcn": "^4.7.0",
     "tailwindcss": "^4",
     "testcontainers": "^11.14.0",
     "tw-animate-css": "^1.4.0",