chore: upgrade Nextjs and resolve npm security advisories

[chenyme]

Summary

Upgrade the frontend and API contract toolchain to current stable releases and remove vulnerable transitive dependency versions reported by Dependabot.

This change:

• Upgrades Next.js from 16.3.0-preview.6 to stable 16.3.0.
• Upgrades shadcn to 4.16.1 and moves the CLI-only package to devDependencies.
• Upgrades swagger-typescript-api to 13.12.6.
• Updates Next.js-generated type references.
• Refreshes pnpm-lock.yaml, including patched sharp, postcss, brace-expansion, js-yaml, fast-uri, undici, and ip-address versions.
• Reduces workspace overrides from 11 entries to a single necessary dompurify 3.4.13 override.
• Retains Monaco Editor 0.55.1 because 0.56.0 changes its ESM export structure and requires a separate editor integration migration.
• Resolves all currently reported pnpm audit advisories.

Change type

• Bug fix
• Feature
• Documentation
• Refactor
• Configuration / deployment
• Security hardening
• Other

Affected areas

• Frontend / UI
• Backend / API
• Authentication / authorization
• Conversations / streaming
• Files / RAG / extraction
• Model routing / providers
• MCP / tools
• Billing / payments
• Admin console
• Deployment / Docker / configuration
• Documentation

Verification

• pnpm audit --json
• pnpm --filter @deeix/web check
• pnpm --filter @deeix/web test
• pnpm --filter @deeix/web build
• GOCACHE=/private/tmp/deeix-deps-api-contract-go-cache pnpm --filter @deeix/api-contract check
• GOCACHE=/private/tmp/deeix-deps-final-go-cache go test ./...
• go vet ./...
• git diff --check
• Not run; reason:

pnpm audit reports zero known vulnerabilities.

Screenshots, API examples, or logs

No UI behavior or API contract changes. Screenshots are not applicable.

Configuration, migration, and compatibility notes

• No database migration or configuration migration is required.
• No public API or generated Swagger contract changes.
• shadcn is now correctly classified as a development-only dependency.
• Next.js-generated route type references now use .next/types.
• The only retained workspace override is dompurify 3.4.13, required because Monaco Editor 0.55.1 directly pins an affected DOMPurify version.
• Monaco Editor 0.56.0 is intentionally excluded because its ESM export changes require a separate integration migration.
• Node.js 24 remains the supported build environment.

Documentation

• Documentation is not needed for this change.
• Documentation was updated.
• Documentation still needs to be updated.

Security and privacy

• No secrets, tokens, credentials, local config, or personal data are included.
• User data access remains scoped by authenticated user context unless an admin-only path explicitly requires broader access.
• Security-sensitive dependency changes were reviewed.
• All currently reported npm audit findings are resolved.

Checklist

• I searched existing issues and pull requests.
• Changes are focused and do not include unrelated refactors.
• Tests or static verification were run where practical.
• User-facing behavior, deployment steps, API contracts, or configuration changes are documented.
• Generated artifacts are included only where required by Next.js.
• Caches, build output, .pyc files, .env files, and local storage data are not committed.