fix(deps): patch Next.js og RCE, clear audit findings, update dependencies

[Gautam25Raj]

Summary

npm audit reported 21 vulnerabilities, including a critical RCE in next/og ImageResponse, which the site, blog, docs and portfolio OG image routes all use. This PR fixes everything with an upstream fix, updates dependencies within their current majors, and cleans up the root overrides.

	Before	After
Critical	1	0
High	14	5
Moderate	6	0

The 5 remaining findings are one chain, braces ← micromatch ← fast-glob@3.3.1 ← @next/eslint-plugin-next. It is only used by lint, never shipped, and has no patched version yet.

Commits

1. fix(deps): security

• Next.js and eslint-config-next 16.3.5 → 16.3.8 (og RCE, image-optimizer SSRF, cache poisoning)
• nodemailer 9 → 10.0.14: there is no patched 9.x. Our createTransport/sendMail usage is unchanged. @types/nodemailer is removed because v10 ships its own types.
• express 4.22.3 (qs 6.16), multer 2.4.0, vitest 4.1.11, postcss 8.5.28 (nanoid 3.3.19)
• Overrides that pinned vulnerable versions are fixed: fast-uri 3.1.8 (the old 3.1.7 pin had never applied to the locked tree) and body-parser 1.20.8
• New overrides mysql2 3.24.5 and deepmerge-ts 8.0.2, both pinned vulnerable inside prisma 7.x

2. chore(deps): updates within current majors

• Prisma 7.10.0, AWS SDK, react-pdf 4.9, docx 9.8.1, lucide-react, prettier 3.9.9, and others
• better-auth is held at ~1.6.25: 1.7 requires a mandatory Account.issuer column and a backfill, so it needs its own migration PR
• site now declares tsx. Its prebuild scripts use it, but it previously only worked through server's hoisted copy.

3. chore(deps): fumadocs pinning and override cleanup

• blog and docs now pin identical exact fumadocs versions
• Removed overrides for packages no longer in the tree (hono, @hono/node-server, better-sqlite3), a no-op (valibot) and nested duplicates of top-level rules. The installed tree is unchanged.

4. chore(release): 3.25.1

• Version 3.25.1 across all workspaces and the Studio and portfolio build labels
• Release notes (release-notes-v3.25.1.md) and the changelog seed entry
• Local setup guide and README: npm 11 or higher is required

Not changed (separate PRs)

Breaking majors (zod 4, eslint 10, TypeScript 7, express 5, vitest 5, redis 6, openai 7, helmet 8, framer-motion 14), better-auth 1.7, and fumadocs 16.15+. The newer fumadocs-mdx and fumadocs-openapi require it, so it has to move as one coordinated upgrade.

Verification

Run on the original tree first as a baseline, then after each commit:

• npm ci --legacy-peer-deps (same as CI), Prisma generate/validate, lint, format
• npm run build for all 8 workspaces
• Tests: server, site and studio contracts, studio PDF parity, portfolio
• Runtime: /api/og on the site and portfolio production builds returns valid PNGs on 16.3.8, and nodemailer 10 composes a message with our exact transport options and fields

Notes for local setup

• Installs that change dependencies need npm 11 (the repo's packageManager: npm@11.16.0). npm 10.9 crashes resolving eslint-config-next@16.3.8 peers. npm ci from the lockfile works on both.
• Studio browser tests (test:browser) need npx playwright install chromium after the Playwright 1.63 bump.