chore(frontend): upgrade next 16.1.6 → 16.2.6

Non-major bump that closes ~19 stacked advisories on the prior
version:

- CVSS 8.6 SSRF (GHSA-c4j6-fc7j-m34r)
- CVSS 8.1 Middleware bypass via dynamic route params (GHSA-492v-c6pp-mqqv)
- CVSS 7.5 DoS × 3 (GHSA-q4gf-8mx6-v5v3, GHSA-8h8q-6873-q5fj, GHSA-26hh-7cqf-hhc6)
- Plus XSS (GHSA-gx5p-jg67-6x7h) and other moderate findings

Verified: `npm run lint` clean, all 212 vitest tests pass.

Remaining npm-audit findings (6 moderate, 4 high) are transitive
dev-time deps (vite, picomatch, flatted) — not in production
bundles.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: mikevitelli

frontend/package.json

@@ -14,7 +14,7 @@
     "@sanity/client": "^7.17.0",
     "@upstash/redis": "^1.37.0",
     "@vercel/analytics": "^2.0.1",
-    "next": "16.1.6",
+    "next": "^16.2.6",
     "next-auth": "^5.0.0-beta.30",
     "react": "19.2.3",
     "react-dom": "19.2.3"