Release: upgrade Next.js to 16.3 and patch vulnerable dependencies

Clears the open security advisories. Next 16.2.x pinned postcss at 8.4.31
and sharp at ^0.34.5, holding both on vulnerable versions regardless of how
the lockfile was refreshed; 16.3 raises those pins to 8.5.23 and ^0.35.3.
The remaining advisories (nanoid, js-yaml, brace-expansion, esbuild,
@babel/core, top-level postcss) resolve within existing semver ranges.

Declares tailwind-merge as a direct dependency. lib/cn.ts imports it, but it
previously resolved only by hoisting from fumadocs-ui, which dropped the
dependency in 16.14 -- leaving the import unresolvable on a clean install.

Builds now check out full git history so each page keeps its own
last-modified date instead of collapsing to the date of the deploy.

Ignores .claude/ local configuration.

Author: Kevin7Qi

.github/workflows/deploy.yml

@@ -18,6 +18,11 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          # Full history: the last-modified plugin derives each page's date from
+          # git log, and the default shallow clone collapses them all to the
+          # date of the deploy.
+          fetch-depth: 0
 
       - name: Setup Node.js
         uses: actions/setup-node@v4

.gitignore

@@ -30,3 +30,6 @@ next-env.d.ts
 # Local reference repos
 .reference/
 test-results/
+
+# Claude Code local config
+.claude/