Clear remaining postcss + sharp Dependabot alerts without the Next 16 major

[mda590]

Closes the last six open Dependabot alerts (sharp #77/#94, postcss #67/#79/#80/#86) while staying on Next.js 15.

Dependabot proposed these as part of #86, which bumps next from 15.5.21 to 16.3.0 — a framework major. That is not required:

• sharp — next@15.5.25 declares sharp: "^0.34.3 || ^0.35.4", so 0.35.4 is already reachable on Next 15. We were resolving to 0.34.5; the override pins resolution to the patched branch.
• postcss — next@15.5.25 pins postcss to exactly 8.4.31 inside its own node_modules, so raising our top-level dep alone leaves the nested copy vulnerable. Raising the direct devDependency to ^8.5.23 and adding an overrides entry of "$postcss" applies that spec everywhere, deduping next's nested copy onto 8.5.28.

Verification

• npm ci + npm run build — clean on Next.js 15.5.25
• npm run lint — no ESLint warnings or errors
• next start smoke test — /, /visualization, /api/latencies, /region-status, /about all return 200 with real rendered content
• Compiled Tailwind CSS is byte-identical to the pre-change build (14871 bytes, 195 rules), confirming the postcss override does not alter style output

Follow-up

Next.js 16 (#86) is still worth doing, but as a deliberate migration rather than a security bump — notably next lint is removed in 16, which would break the current lint script.

🤖 Generated with Claude Code

https://claude.ai/code/session_01JgBXidouB5LfaxhmPgtUta

[mda590]

Obsolete: merging #95 (Next.js 16) resolved these natively — next@16.3.4 pins postcss 8.5.23 and allows sharp ^0.35.3, so main now resolves postcss 8.5.23 and sharp 0.35.4 with no overrides needed. All six alerts (sharp #77/#94, postcss #67/#79/#80/#86) are closed, and the repo has zero open Dependabot alerts. Adding overrides on top would be redundant machinery.

The Next 16 migration that #95 skipped is in #97.