chore(deps): dependency + security-alert sweep

[Musiker15]

Clears the open Dependabot PRs and the 10 open Dependabot alerts. All alerts
were development-scope (the pnpm audit --prod --audit-level=high gate was
already clean); this closes them at all severities.

Version bumps

• nodemailer 9.0.1 -> 9.0.3 (supersedes chore(deps): bump nodemailer from 9.0.1 to 9.0.3 #113)
• next 16.2.6 -> 16.2.9, react + react-dom 19.2.6 -> 19.2.7, react-hook-form
  7.77.0 -> 7.80.0 (the "next group", chore(deps): bump the next group across 1 directory with 4 updates #99)
• @types/node 25 -> 26 (chore(deps-dev): bump @types/node from 25.9.1 to 26.0.0 in the types group across 1 directory #98), prettier 3.8.3 -> 3.9.5 (chore(deps-dev): bump prettier from 3.8.3 to 3.9.5 #107) with a one-off
  prettier --write tree reformat
• CI actions: actions/checkout v6 -> v7 (chore(deps): bump actions/checkout from 6 to 7 #110), actions/cache v5 -> v6 (chore(deps): bump actions/cache from 5 to 6 #111)

Override-based alert fixes (pnpm-workspace.yaml)

• vite -> ^6.4.3 (GHSA-4w7w-66w2-5vf9, GHSA-jqfw-vq24-v9c3)
• js-yaml 4.x -> ^4.2.0 (GHSA-mh29-5h37-fv8m)
• @babel/core -> ^7.29.6 (GHSA-67hx-6x53-jw92)
• undici is intentionally NOT pinned via an override: a clean resolve already
  lands on the patched 7.28.0 that jsdom accepts, and forcing it out of jsdom's
  own resolution broke the vitest jsdom worker.

Superseded Dependabot PRs (to close, already past these versions on the sweep)

• chore(deps): bump nodemailer from 8.0.10 to 9.0.0 #106 nodemailer 9.0.0 (we are at 9.0.3, and 9.0.0 is itself vulnerable)
• chore(deps-dev): bump tsx from 4.22.3 to 4.22.4 #102 tsx 4.22.4 (already at 4.23.1)
• chore(deps): bump yjs from 13.6.30 to 13.6.31 #100 yjs 13.6.31 (already at 13.6.31)

Verification

pnpm audit (all severities) reports no known vulnerabilities. typecheck +
lint + 315 tests + build green.