Fix 5 high-severity vulnerabilities

Changes in docs/:
- package.json: added a sharp override (^0.35.3) since next's own optional dep still points to a vulnerable libvips-based sharp build.
- package-lock.json: next bumped to 16.2.12, postcss to 8.5.25, sharp to 0.35.3, plus transitive brace-expansion/js-yaml bumps — all within existing semver ranges, no code changes needed.

Build (npm run build) still passes. Nothing was committed — let me know if you want that pushed.

Author: aeiwz

docs/next-env.d.ts

@@ -1,6 +1,6 @@
 /// <reference types="next" />
 /// <reference types="next/image-types/global" />
-import "./.next/dev/types/routes.d.ts";
+import "./.next/types/routes.d.ts";
 
 // NOTE: This file should not be edited
 // see https://nextjs.org/docs/app/api-reference/config/typescript for more information.