fix: upgrade Next.js to 16.2.12 and pin patched tar (npm audit, #214)

[Golchic]

What

Addresses the critical and runtime-exploitable advisories from #214.

Change	Effect
next 16.1.0 → 16.2.12	Clears every Next.js advisory pnpm audit reports — SSRF in Server Actions & rewrites, App Router / Pages middleware & proxy bypass, multiple DoS vectors, beforeInteractive XSS. Stays on the 16.2.x line noted in the issue.
Add pnpm.overrides "tar@<7.5.19" → ">=7.5.19"	@tailwindcss/oxide floats tar at ^7.4.3, but the lockfile pinned 7.4.3, which carries a critical decompression DoS (GHSA-23hp-3jrh-7fpw) plus several hardlink/symlink path-traversal advisories. Override resolves tar@7.5.22.
Regenerate pnpm-lock.yaml	Migrates lockfileVersion 6.0 → 9.0. The repo already pins packageManager: pnpm@9.15.1, so the committed 6.0 lockfile was stale — any pnpm install regenerates it as 9.0. This is why the lockfile diff is large.
next-env.d.ts	Regenerated by Next 16.2 (routes.d.ts path change).

Result

pnpm audit: 62 vulnerabilities (1 critical / 33 high / 24 moderate / 4 low) → 19 (0 critical / 12 high / 6 moderate / 1 low).

The remaining 19 are all build-time-only transitive deps: js-yaml / svgo under @svgr/webpack, postcss pinned inside styled-jsx, and sharp under next. This site is statically exported, so none are in the deployed runtime. Clearing them would require forced major-version overrides on shared build tooling (and nanoid can't be bumped without breaking postcss@8), so they're left out of this security-focused PR.

Verification

• pnpm install — clean
• pnpm build — passes, all 3 pages generated (Next.js 16.2.12, Turbopack)

Fixes #214

[vercel]

@Golchic is attempting to deploy a commit to the openai Team on Vercel.

A member of the Team first needs to authorize it.