fix: resolve dependabot security alerts

[narcisonunez]

Resolves all open Dependabot alerts with dependency-only changes (no source code changes).

Direct dependencies

• next 16.3.3 → 16.3.8 (website + docs) — includes critical fix
• sharp ^0.33.5 → ^0.35.4 (website) — og-image.ts only uses sharp(buf).png().toBuffer(), unchanged API
• axios ^1.8.1 → ^1.20.0 (website)
• resend 6.9.3 → 6.12.3 (website) — newer svix drops the vulnerable uuid

Transitive (via resolutions, version-range scoped, same major)

@babel/core, @babel/helpers, axios, baseline-browser-mapping, brace-expansion, browserslist, fast-uri, fflate, follow-redirects, glob, image-size, js-yaml, mdast-util-to-hast, minimatch, nanoid, openapi-sampler (pulls fast-xml-parser 5.x), path-to-regexp, picomatch, postcss, postcss-selector-parser, yaml

Verification

• pnpm build passes for both website and docs
• pnpm typecheck: 43 errors, same as on main (pre-existing, unrelated)