fix: resolve production npm audit findings

[mksocial19-code]

Summary

This combines the safer parts of #48 with the missing PostCSS override needed to clear the production npm audit.

Changes:

• Bump next to 16.2.7
• Bump eslint-config-next to 16.2.7
• Move shadcn from runtime dependencies to devDependencies
• Add npm override for postcss ^8.5.10
• Refresh package-lock.json

Why

#38 still leaves production audit vulnerabilities. #48 gets much closer, but npm audit --omit=dev still reports next/bundled postcss. Adding the PostCSS override on top of #48 clears the production audit while keeping the build green.

Verification

Run with Node 24 / npm 11:

npm ci
npm run check
npm audit --omit=dev --json
npm audit --json

Results:

• npm ci ✅
• npm run check ✅ lint, typecheck, and Next build passed
• npm audit --omit=dev --json ✅ 0 production vulnerabilities
• npm audit --json still reports dev-only transitive findings

No runtime behavior changes intended.