#8821 fix(deps): bump next, @sentry/nextjs and vite to resolve Dependabot alerts

Summary

Bumps next 16.3.8 → 16.4.1 (root override + api, docs, marketing, web), @sentry/nextjs 10.68.0 → 10.75.2 (api, docs, marketing, web) and vite 7.3.5 → 7.3.7 (desktop, ui). Lockfile refreshed.

Alerts resolved:

• #397, #412, #408, #417 (high): Next.js DoS in App Router using Server Actions
• #398, #413, #409, #418 (critical): Next.js RCE in Image Optimization API with SVG files
• #400, #415, #411, #420 (critical): Next.js RCE in use cache functions returning typed arrays
• #399, #414, #410, #419 (critical): Sentry-Javascript middleware bypass when using Tunnel route
• #395, #394, #387, #386, #373 (ui) and #389, #388, #377, #376, #360 (desktop): Vite / launch-editor alerts (low to high)

Not in this PR:

• storybook, @modelcontextprotocol/sdk, hono: covered by #8776 and the open Dependabot PRs.
• electron (#402–#407, #390): needs 42.11.9, a 41 → 42 major bump. Left for a human (#8739 only reaches 42.11.3).

Test plan

• bun install
• bun run lint:fix (clean, no fixes)
• bun run typecheck in apps/api, docs, marketing, web, desktop and packages/ui
• CI

---

Summary by cubic

Bumps next 16.3.8 → 16.4.1, @sentry/nextjs 10.68.0 → 10.75.2, and vite 7.3.5 → 7.3.7 to resolve Dependabot alerts for Next.js DoS/RCE and Sentry tunnel route bypass. Lockfile refreshed; lint, typecheck, and install all pass.

• Applies the root next override plus updates in api, docs, marketing, web, and vite in desktop and ui.
• Leaves out electron alert fixes – they require a 41 → 42 major bump that should be handled separately.

Summary by CodeRabbit

• Chores
  • Updated the frameworks and development tooling used across the API, desktop app, documentation, marketing site, web app, and shared UI package.
  • These maintenance updates do not change user-facing features.