#126 Upgrade Next.js to 16.3.8

Summary

• Bump next from 16.3.5 to 16.3.8 (current latest dist-tag) in web/package.json.
• Regenerate package-lock.json with npm 11 so only next, @next/env, and @next/swc-* versions change (existing libc metadata preserved).

Verification

• tsc --noEmit in web/: passes
• npm run build (next build --webpack): passes
• vitest run: 321 passed, 1 skipped. One test, lib/test/flow-push-guard.test.ts, hit its 5s timeout in the full run and passes 18/18 when run alone. It's a known timing flake unrelated to Next; a fix is on the separate fix/flow-push-guard-test-timeout branch.
• Not run: opennextjs-cloudflare build, preview, or e2e, because agents can't preview or deploy.

🤖 Generated with Claude Code

---

[!NOTE]
Low Risk
Patch bump of the Next.js runtime and SWC binaries with no application code changes; typical low-risk maintenance.

Overview
Bumps the Next.js framework from 16.3.5 to 16.3.8 in web/package.json and refreshes package-lock.json so next, @next/env, and all platform @next/swc-* optional binaries align on 16.3.8. The lockfile also reorders web devDependencies (esbuild listed before wrangler) without changing versions.

This is a patch-level dependency update only; no app source or config changes are included in the diff.

^{Reviewed by Cursor Bugbot for commit 646f9ccdd12b835d15db71fe01a0407da6758abf. Bugbot is set up for automated code reviews on this repo. Configure here.}