fix(deps): clear all high-severity advisories and green the Security gate

`.github/workflows/security.yml` gates on `pnpm audit --audit-level=high`.
That command has been exiting 1 — the Security workflow has been failing
on main since 2026-08-03, so the repo has had no working dependency
alarm for over a month.

Starting point: 21 advisories (14 moderate, 7 high) on `--prod`, plus
4 more high in dev dependencies that `--prod` hides but the CI gate sees.

Every production path resolved through apps__web. The six published
@orbital-stellar/* packages were clean — this was the web app's tree,
not the packages users install.

  next     ^16.2.10 -> ~16.2.12   middleware/proxy bypass, 2x SSRF, DoS
  axios     1.17.0  -> ^1.18.0    inherited proxy, prototype pollution
  js-yaml@3 ^3.15.0 -> ^3.15.1    quadratic !!omap CPU consumption
  js-yaml@4  (new)  -> ^4.3.1     same, via @redocly/openapi-core
  fast-uri   (new)  -> ^3.1.5     host confusion, via ajv
  nanoid     (new)  -> ^3.3.17    infinite loop on non-integer size
  sharp      (new)  -> ^0.35.0    inherited libvips advisories

next is pinned with `~` to stay on the 16.2 line. `^16.2.11` resolves to
16.3.0, which patches the same advisories but is a far wider change than
a security fix should carry — and its build was slow enough here to look
like a hang. 16.2.12 is the smallest version that clears all four.

js-yaml needs both majors pinned separately: 3.x arrives via gray-matter
and 4.x via openapi-typescript, and collapsing them to one range would
drag a consumer across a major boundary.

Overrides stay in pnpm-workspace.yaml. A `pnpm.overrides` block in the
root package.json silently disables every override in this file, so the
root manifest deliberately has no `pnpm` field.

Result: `pnpm audit` reports no known vulnerabilities at any severity,
and `pnpm audit --audit-level=high` exits 0. apps/web builds green on
16.2.12; all 22 routes generate as before.

Not fixed here: test/generate.contractSpec.test.ts in abi-registry times
out at its 60s limit when run alongside the rest of that package's suite
(it compiles TypeScript for real, ~32-44s standalone). Confirmed
pre-existing by reproducing it on unmodified main deps — unrelated to
these bumps, but it does mean `pnpm -r test` is currently red.

Author: Salmatcre8

apps/web/package.json

@@ -22,7 +22,7 @@
     "geist": "^1.7.2",
     "gray-matter": "^4.0.3",
     "marked": "^18.0.6",
-    "next": "^16.2.10",
+    "next": "~16.2.12",
     "react": "^19.2.8",
     "react-dom": "^19.2.8",
     "react-markdown": "^10.0.0",