build(deps): patch security advisories in www and examples (#7581)

Layer 10 (final) of a stacked dependency upgrade. Stacked on #7580.

Finishes the audit sweep, covering the workspaces that aren't published
to npm.

| package | from | to | advisory needs |
| --- | --- | --- | --- |
| `next` | ^15.3.8 | ^15.5.25 | >=15.5.24 |
| `next-auth` | ^4.24.11 | ^4.24.15 | >=4.24.15 |
| `next-auth` (2 examples) | 5.0.0-beta.25 | 5.0.0-beta.32 |
>=5.0.0-beta.32 |
| `postcss` | ^8.4.39 | ^8.5.28 | >=8.5.23 |
| `nuxt` | ^3.16.1 | ^3.21.11 | >=3.21.10 |
| `wrangler` | ^4.14.1 | ^4.131.1 | >=4.59.1 |
| `esbuild` | ^0.17.10 | ^0.28.2 | >=0.25.0 |

**`next` stays within 15.x.** 16.x is available, but that's a framework
major across nineteen workspaces — not a security patch, and not
something to smuggle into an audit PR.

### Result: 573 → 278 findings, and **no remaining advisory is fixable
by bumping a declared dependency**

What's left is entirely transitive, behind dependencies that each need
their own migration:

| entry point | why it's not a bump |
| --- | --- |
| `www > @docusaurus/*` | docusaurus 3's dependency tree |
| `. > lerna` | there's already a `chore/migrate-lerna-to-changesets`
branch |
| `examples/lambda-url`, `examples/lambda-api-gateway` | serverless v3
(EOL) |
| `packages/openapi > @swagger-api/apidom-ls` | upstream's own tree |
| `eslint-config-next` (2 examples) | follows the Next major |

Happy to open a tracking issue for these if useful.

### Verification
`pnpm build`, `typecheck-packages`, `typecheck-www`, `monotest-build`,
`lint` (42/42) and `manypkg check` all pass; `pnpm test` is 1130/1131
with only the pre-existing `httpSubscriptionLink.memory.test.ts`
WeakRef/GC failure.

The riskiest example upgrades were checked individually beyond the
standard gates — `.experimental/next-app-dir` (the next-auth beta jump),
`nuxt`, `cloudflare-workers` and `next-sse-chat` all typecheck, and the
first two build. `next-sse-chat`'s prebuild needs `DATABASE_URL` and
fails locally for that reason on `main` too; it's commented out of the
CI e2e matrix.

🤖 Generated with [Claude Code](https://claude.com/claude-code)


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

- **Chores**
  - Updated Next.js across examples, packages, and website tooling.
- Refreshed authentication, styling, WebSocket, build, framework, and
code-generation tooling versions.
- Centralized the workspace Next.js version for consistent package
configuration.
- Updated Cloudflare Workers, Nuxt, OpenAPI, and related example
dependencies.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: Charon <charon@charon.localdomain>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: 3 people

package.json

@@ -39,7 +39,7 @@
     "@trpc/react-query": "npm:@trpc/react-query",
     "@trpc/server": "npm:@trpc/server",
     "clsx": "^2.0.0",
-    "next": "^15.3.8",
+    "next": "^15.5.25",
     "react": "^19.1.0",
     "react-dom": "^19.1.0",
     "superjson": "^1.12.4",
@@ -56,7 +56,7 @@
     "eslint-plugin-react": "^7.37.5",
     "eslint-plugin-react-hooks": "^7.1.1",
     "npm-run-all": "^4.1.5",
-    "postcss": "^8.4.39",
+    "postcss": "^8.5.28",
     "prettier": "^3.9.6",
     "prisma": "^6.7.0",
     "start-server-and-test": "^1.12.0",