Update dependency @types/node to v25 - autoclosed - #92

* Update dependencies and regenerate bun.lock

Run `bun update --latest` under the 14-day cooldown, then regenerate
bun.lock from scratch. Every direct dependency is on its latest major.

Direct changes:
- next 16.3.8 -> 16.4.1 (exact pin). Fixes GHSA-2464-fhr4-w9xw and
  GHSA-673q-mjm6-r5xr (critical RCE) and GHSA-p3m5-59mp-jv5r (high DoS).
  16.4.2 and 16.4.3 are bug-fix backports only and are 12 and 4 days
  old, so they wait for Renovate.
- react, react-dom ^19.2.8 -> ^19.3.1. 19.3.1 hardens the RSC transport
  protocol; React shipped it to every supported line on the same day.
- resend ^6.19.0 -> ^6.32.1. 6.33.0+ is inside the window (6.35.0 is
  0 days old).
- @biomejs/biome ^2.5.8 -> ^2.5.15. 2.6.x is 3-6 days old.
  biome.json schema migrated with `biome migrate`.
- @playwright/test ^1.62.1 -> ^1.64.0. 1.64.1 is 13 days old.
- @types/react, @types/react-dom -> ^19.3.0.
- @types/node ^24.13.3 -> ^24.19.2. Held on 24 to match .nvmrc,
  engines.node and the newest Node major Vercel deploys.
- overrides.sharp ^0.35.3 -> ^0.35.5 (GHSA-wq5f-xc86-pv6w, librsvg).
  Still needed: velite 0.4.0 declares sharp ^0.34.5.

Already latest: typescript 7.0.2, tailwindcss and @tailwindcss/postcss
4.3.3, velite 0.4.0, @lhci/cli 0.15.1, feed, ogl, next-plausible,
@vercel/analytics, rehype-pretty-code, @tailwindcss/typography.

Cooldown exemptions (bunfig.toml minimumReleaseAgeExcludes):
- next + @next/env + @next/swc-*: next 16.4.1 (13 days) carries the
  critical RCE fixes; next pins its @next/* packages to the same version.
- react, react-dom: 19.3.1 (13 days) RSC transport hardening.
All entries expire after 2026-10-29, when both versions pass 14 days.

Vetting: no GitHub malware advisory matches any of the 611 resolved
package versions (checked with the GitHub advisories API, type=malware).
`bun audit` reports no advisory in next, react, sharp or any other
runtime dependency.

Verified: bun run build, typecheck, check:ci, verify (17/17) and
Playwright (18/18, desktop + mobile).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Will Manning <will@willmanning.io>

* Cap @types/node below 25 in Renovate

Renovate keeps opening @types/node 25.x and 26.x PRs (#92, #94). Node
26 is not deployable on Vercel, and CLAUDE.md requires @types/node to
match .nvmrc and engines.node, so those PRs can never merge. Add
allowedVersions "<25" so Renovate only proposes 24.x updates. Raise the
cap together with .nvmrc and engines.node.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Will Manning <will@willmanning.io>

* Refresh audit advisories in CLAUDE.md

Record the `bun audit` state after the dependency update (10 advisories,
none in the client bundle or server runtime):

- sharp override now targets ^0.35.5 for GHSA-wq5f-xc86-pv6w.
- New, fix inside the cooldown: body-parser GHSA-27r3-jxmh-p828 and qs
  GHSA-6pq8-jhm2-2vcw (via @lhci/cli > express, lhci server never runs);
  postcss-selector-parser GHSA-rj75-hqrm-r3gf (build-only, via
  @tailwindcss/typography's exact pin; add an override after 2026-11-03).
- New, upstream-blocked via @lhci/cli: extract-zip GHSA-7pqw-9j4j-h8q3,
  zod GHSA-mrhx-c7xc-m3w5 (no 3.x fix), basic-ftp GHSA-c475-qrg2-pj4r
  (fix only on the 6.x major).
- Document the minimumReleaseAgeExcludes entries and their expiry, and
  the Renovate cap on @types/node.
- Drop the "cleared, for the record" note on postcss and
  mdast-util-to-hast; it is in git history.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Will Manning <will@willmanning.io>

---------

Signed-off-by: Will Manning <will@willmanning.io>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>