[build] align patched Next toolchain and reviewed license records

Advance Next and its lint plugin to 16.4.3, retain exact security pins, and refresh the reviewed @next/env license fallback and generated notices. The upstream v16.4.3 MIT license retains the recorded Vercel attribution.

Validation: locked install, formatting, ESLint, typecheck, 17 focused build/config tests, license check, and 19-page static export pass. Shared audit findings remain for the coordinated dependency update.
Signed-off-by: Viwat Vchirawongkwin <viwat.v@chula.ac.th>

Author: yyods

tools/web/package-lock.json

@@ -29,15 +29,15 @@
   "dependencies": {
     "@material/web": "2.2.0",
     "esp-web-tools": "10.4.0",
-    "next": "16.4.0",
+    "next": "16.4.3",
     "react": "19.2.8",
     "react-dom": "19.2.8",
     "react-server-dom-webpack": "19.2.8",
     "vinext": "1.0.0-beta.8"
   },
   "devDependencies": {
     "@eslint/js": "10.0.1",
-    "@next/eslint-plugin-next": "16.3.4",
+    "@next/eslint-plugin-next": "16.4.3",
     "@testing-library/jest-dom": "7.0.0",
     "@testing-library/react": "16.3.2",
     "@types/node": "26.1.2",

tools/web/package.json

@@ -563,11 +563,11 @@ License file: LICENSE
    limitations under the License.
 
 ================================================================================
-@next/env 16.3.4
+@next/env 16.4.3
 Installed path: node_modules/@next/env
 SPDX license: MIT
-Source: https://registry.npmjs.org/@next/env/-/env-16.3.4.tgz
-License file: reviewed fallback for node_modules/@next/env@16.3.4
+Source: https://registry.npmjs.org/@next/env/-/env-16.4.3.tgz
+License file: reviewed fallback for node_modules/@next/env@16.4.3
 
 The MIT License (MIT)
 
@@ -3995,10 +3995,10 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
 ================================================================================
-next 16.3.4
+next 16.4.3
 Installed path: node_modules/next
 SPDX license: MIT
-Source: https://registry.npmjs.org/next/-/next-16.3.4.tgz
+Source: https://registry.npmjs.org/next/-/next-16.4.3.tgz
 License file: license.md
 
 The MIT License (MIT)

tools/web/public/WEBSITE_THIRD_PARTY_LICENSES.txt

@@ -60,7 +60,7 @@ SOFTWARE.`;
 
 const reviewedLicenseFallbacks = {
   "node_modules/@next/env": {
-    version: "16.3.4",
+    version: "16.4.3",
     text: mitLicense(
       "Copyright (c) 2025 Vercel, Inc.",
       "The MIT License (MIT)",

tools/web/scripts/generate-website-third-party-licenses.js

@@ -106,16 +106,16 @@ describe("production build contract", () => {
       ),
     );
 
-    expect(packageJson.dependencies?.next).toBe("16.3.4");
+    expect(packageJson.dependencies?.next).toBe("16.4.3");
     expect(packageJson.devDependencies?.["@next/eslint-plugin-next"]).toBe(
-      "16.3.4",
+      "16.4.3",
     );
     expect(packageJson.devDependencies?.vitest).toBe("4.1.12");
     expect(packageJson.overrides?.next?.sharp).toBe("0.35.5");
     for (const [name, version] of [
-      ["next", "16.3.4"],
-      ["@next/env", "16.3.4"],
-      ["@next/eslint-plugin-next", "16.3.4"],
+      ["next", "16.4.3"],
+      ["@next/env", "16.4.3"],
+      ["@next/eslint-plugin-next", "16.4.3"],
       ["sharp", "0.35.5"],
       ["vitest", "4.1.12"],
       ["@vitest/mocker", "4.1.12"],