[P1] Address high-severity npm audit vulnerabilities in production dependency chain

[itsmiso-ai]

Problem: npm audit reports high-severity vulnerabilities in the production dependency chain. The sharp package (transitive dependency of next) has unpatched libvips CVEs (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591). Additionally, find-my-way (via @prisma/dev, but @prisma/dev is a dev-only build-time dependency) has a high-severity HTTP/2 DDoS advisory (GHSA-c96f-x56v-gq3h). While the worst of these are in transitive or dev-only deps, the sharp vulnerabilities ship in the production Docker image and represent real risk.

Evidence:

$ npm audit --json | jq ".vulnerabilities | keys"
[
  "@prisma/dev",    # dev-only, not shiped
  "brace-expansion", # dev-only via eslint-config-next
  "eslint-config-next", # dev-only
  "find-my-way",    # via @prisma/dev (dev-only)
  "next",           # production — via sharp
  "sharp",          # production — CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591
  "valibot"         # via @prisma/dev (dev-only)
]

The sharp advisory: GHSA-f88m-g3jw-g9cj — libvips vulnerabilities causing denial of service and potential arbitrary code execution.

Acceptance:

• sharp is upgraded to >=0.35.0 in the lockfile (via next upgrade or an override)
• npm audit reports zero production-scope high-severity advisories
• Docker image passes trivy image --severity CRITICAL,HIGH (already in CI, but the scan should show no production CVEs beyond OS-package unfixed items)
• CI build succeeds with the updated dependency resolution