fix: resolve dependency audit findings

[rajat1saxena]

Summary

Applies non-breaking dependency updates via pnpm audit --fix update (within existing semver ranges; no major bumps, no --force).

Vulnerability counts

Severity	Before	After
critical	3	0
high	51	10
moderate	46	10
low	8	2
total	108	22

Notable fixed packages

• next ^16.2.9 → ^16.3.7 (clears critical RCE advisories)
• postcss, nanoid, liquidjs, vitest, @grpc/grpc-js, undici, hono, and related transitive updates via lockfile
• Direct workspace package.json ranges refreshed within ^ for api/web/docs/email-* packages and root tooling

Also updates pnpm-workspace.yaml minimumReleaseAgeExclude entries so pnpm can install the patched versions.

Remaining issues (not fixed — would require major bumps)

Left unfixed intentionally (breaking majors / out-of-range):

• nodemailer — remaining advisories need ≥10.x (currently ^9.1.1)
• Several transitive leftovers (esbuild/tsup paths, some nested postcss/nanoid/qs/browserslist/@opentelemetry/core, pnpm CLI itself <11.11.0, ts-deepmerge major, etc.) that pnpm audit --fix update could not resolve within current ranges

Verification

• pnpm audit re-run after fix (counts above)
• Built shared packages, then pnpm test — all passed (api/web/email-editor/email-blocks)

Test plan

• pnpm audit before/after
• pnpm test after building workspace packages
• CI green on this PR

[rajat1saxena]

Audit follow-up (2026-10-01 IST)

Additional non-breaking fixes pushed to this branch:

Package	Change	Severity cleared
pnpm (packageManager / devEngines)	11.10.0 → 11.11.0	3 high (pnpm advisories)
@opentelemetry/core	2.7.1 → 2.9.0 (override >=2.8.0 <3)	moderate
qs	6.15.3 removed → 6.16.0 (override >=6.16.0 <7)	moderate

Audit counts on this branch: 15 → 9 (2 low / 5 moderate / 2 high)

Remaining still need majors (nodemailer ≥10, esbuild 0.x jumps, ts-deepmerge 8, tsup 8).

Verified: pnpm install --frozen-lockfile, lint, prettier --check, CI package builds, pnpm test (all green).

[rajat1saxena]

Closing to reopen under the Codelit bot account (clbotdev).