fix: update dependencies for new high and critical advisories

[FrkAk]

Summary

Task Reference: none

Clears the high and critical advisories that fail bun audit --audit-level=high on main.

• next and eslint-config-next move to ~16.3.8 (GHSA-cjq9-62q9-8jv4, GHSA-vcvr-r3jv-pc5j). The tilde keeps this a patch bump; 16.4 is left for its own PR.
• @modelcontextprotocol/sdk 1.30.0 to 1.32.1 (GHSA-6qxp-vccf-f47h).
• The undici and sharp override floors rise to 7.29.1 and 0.35.5, and the //overrides note lists the new advisories.
• proxy-addr, source-map-js and brace-expansion refresh in the lockfile within their parents' ranges.
• braces has no fixed release, so CI ignores GHSA-vfj7-8cjw-p6xm. It is reachable only through the lint toolchain and absent from bun audit --prod.

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Documentation

Testing

• Tested locally with bun run dev
• Linting passes (bun run lint)
• Typecheck passes (bun run typecheck)
• Workers smoke passes (bun run build:cf && bun run smoke:cf)

Full suite passes locally (2,366 tests). The audit passes with only the documented ignore.

Notes for reviewer

The three lint warnings are pre-existing.

Docs impact

• none

Compliance impact

• none