Repin the dependency overrides that had drifted onto vulnerable versions

[fjbarrett]

Summary

npm audit --audit-level=high is failing every PR right now, including #329. The cause is the overrides block: it pins three transitive deps for reproducible CI resolution, and advisories have since landed on all three pinned versions. The pinning was holding the build on exactly the vulnerable releases.

• undici moves to the first patched release in each line its parent accepts — 6.28.0 for @vercel/blob (^6.23.0) and 7.29.0 for jsdom (^7.25.0). Clears the response-desync, cache-disclosure, CRLF-injection and cookie-injection advisories.
• The next → postcss override goes entirely. next declares postcss@8.5.23, already past the sourceMappingURL path-traversal advisories. The override was dragging it back to 8.5.16 and reintroducing them.
• Lockfile refresh picks up patched next (16.3.0), next-auth (5.0.0-beta.32) and @auth/core (0.41.3). That last one matters most: the critical Auth.js advisory (GHSA-8fpg-xm3f-6cx3) has existence-based auth checks fail open when the config errors, and proxy.ts gates the whole API on exactly that shape of check (if (!req.auth && !publicApi)).

No dependencies / devDependencies ranges change. Every version this moves to was already inside the declared ranges — the lockfile had simply gone stale against them.

Test plan

• npm audit --audit-level=high → found 0 vulnerabilities (was 5 high, 2 critical)
• Verified from a clean rm -rf node_modules && npm install, so the result is the tree npm ci reproduces rather than local drift
• npx tsc --noEmit clean
• npm test — 162 pass
• npm run build clean