Bump Next.js to 16.3.5 to clear the critical audit finding (#249)

`npm audit --audit-level=critical --omit=dev` failed on master because
next 16.2.6 carries GHSA-6gpp-xcg3-4w24 (proxy bypass), GHSA-m99w-x7hq-7vfj
(Server Actions DoS) and GHSA-89xv-2m56-2m9x (Server Actions SSRF), all
patched at 16.2.11. That turned the `npm audit` CI job red on every PR.

- next ^16.0.0 -> ^16.3.5 (16.2.6 -> 16.3.5, latest in the major)
- `npm audit fix` (no --force) for the transitive prod findings: sharp
  0.34.5 -> 0.35.4, undici 7.25.0 -> 7.29.1, qs 6.15.3 -> 6.16.0, postcss
  8.5.14 -> 8.5.23, nanoid, hono, @hono/node-server, fast-uri, ip-address,
  dompurify, brace-expansion. All semver-compatible.
- next-env.d.ts regenerated by 16.3 (adds the root-params import); Next
  rewrites it on every build, so committing it keeps checkouts clean.

Left alone: nodemailer (8 -> 10 is a major; the remaining high finding).

Verified locally: `npm audit --audit-level=critical --omit=dev` exits 0
(15 -> 2 findings; the two left are nodemailer), `tsc --noEmit` clean,
vitest 171 files / 2238 tests pass, `next build` exits 0 with the Proxy
(Middleware) line present.


Claude-Session: https://claude.ai/code/session_01QuUkTrofSjQ15j79mRuy4f

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: ralyodio

next-env.d.ts

@@ -1,6 +1,7 @@
 /// <reference types="next" />
 /// <reference types="next/image-types/global" />
 import "./.next/types/routes.d.ts";
+import "./.next/types/root-params.d.ts";
 
 // NOTE: This file should not be edited
 // see https://nextjs.org/docs/app/api-reference/config/typescript for more information.