chore(deps): bump next 15.5.15 → 15.5.18 — closes 13 GHSA advisories

Patches the Next.js block flagged by Dependabot, including the highest-
impact runtime issues:
- SSRF via WebSocket upgrades (CVSS 8.6, GHSA-c4j6-fc7j-m34r)
- Middleware/proxy bypass via dynamic route param injection (8.1)
- Middleware/proxy bypass via segment-prefetch routes + i18n
- DoS via Server Components, Cache Components, Image Optimization
- XSS in beforeInteractive scripts, CSP-nonce App Router
- Cache poisoning in RSC responses + Middleware redirects

Lockstep eslint-config-next bumped to 15.5.18.

6 transitive alerts remain (mcp-sdk hono/fast-uri/ip-address/express-
rate-limit + Next-vendored postcss). All gated on upstream releases —
no runtime-reachable code paths in this app. See CLAUDE.md §12.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: josers18

package-lock.json

@@ -40,7 +40,7 @@
     "clsx": "^2.1.1",
     "ioredis": "^5.4.1",
     "lucide-react": "^0.454.0",
-    "next": "^15.5.15",
+    "next": "^15.5.18",
     "openai": "^6.34.0",
     "pg": "^8.13.1",
     "react": "^18.3.1",
@@ -60,7 +60,7 @@
     "@types/react-dom": "^18.3.1",
     "autoprefixer": "^10.4.20",
     "eslint": "^8.57.1",
-    "eslint-config-next": "^15.5.15",
+    "eslint-config-next": "^15.5.18",
     "postcss": "^8.4.47",
     "tailwindcss": "^3.4.14",
     "typescript": "^5.6.3"