build(deps): refresh web dependency group

[AetherAI3]

Outcome

Combines the open web Dependabot updates into one current-main lockfile refresh.

Direct updates:

• Next / eslint-config-next 16.2.11 → 16.3.5
• React / React DOM / react-server-dom-webpack 19.2.8 → 19.3.0
• React type packages → 19.3.0
• @cloudflare/vite-plugin 1.51.3 → 1.57.2
• @vitejs/plugin-react 6.0.4 → 6.1.1
• tsx 4.23.1 → 4.23.15
• Vite 8.1.5 → 8.3.0
• Wrangler 4.121.0 → 4.136.2
• transitive js-yaml 4.3.1 → 4.3.2 security backport

The Cloudflare, tsx, and Wrangler targets were refreshed to their current releases rather than retaining last week's stale Dependabot values.

Local verification

• reproducible install of every JavaScript workspace (node scripts/install-js.mjs)
• web lint
• production web build
• git diff --check

The scratch sandbox denies tsx's local IPC socket (listen EPERM), so GitHub CI is the authoritative unit-test run.

Supersedes #88 and #91. Built from main after #95.