diff --git a/.claude/skills/persuasion-review/scripts/probe_harness.py b/.claude/skills/persuasion-review/scripts/probe_harness.py
index a4e25582..bacd9398 100644
--- a/.claude/skills/persuasion-review/scripts/probe_harness.py
+++ b/.claude/skills/persuasion-review/scripts/probe_harness.py
@@ -33,7 +33,8 @@ def wait_http_ready(url: str, timeout_sec: float) -> bool:
     deadline = time.time() + timeout_sec
     while time.time() < deadline:
         try:
-            # nosemgrep: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected -- url is a loopback readiness probe (127.0.0.1:<free_port>) for a process this harness itself spawns in a dev/skill workflow; it is never a remote-attacker-controlled URL.
+            if not url.startswith("http://") and not url.startswith("https://"):
+                raise ValueError("Only http and https are allowed")
             urllib.request.urlopen(url, timeout=1).read()
             return True
         except Exception:
diff --git a/AGENTS.md b/AGENTS.md
deleted file mode 100644
index 1de8ae17..00000000
--- a/AGENTS.md
+++ /dev/null
@@ -1,9 +0,0 @@
-# AGENTS.md
-
-## Code-owner review gates — disabled (on hold)
-
-As of 2026-08-04, code-owner review requirements (`require_code_owner_reviews` in branch
-protection, `require_code_owner_review` in rulesets) are disabled across the ContextualWisdomLab
-org: there is a single maintainer (solo developer), so a code-owner approval gate can never be
-satisfied. This is ON HOLD until the org has multiple maintainers — do NOT re-enable these
-settings or add CODEOWNERS-based merge gates before then.
diff --git a/package.json b/package.json
index 98091908..bea121a6 100644
--- a/package.json
+++ b/package.json
@@ -20,16 +20,27 @@
     "overrides": {
       "@babel/core": "7.29.7",
       "esbuild": "0.28.1",
-      "js-yaml": "^4.3.0",
-      "fast-uri": "^3.1.4",
-      "@auth/core": "^0.41.3",
-      "sharp": "^0.35.0",
-      "postcss": "^8.5.18",
-      "hono": "^4.12.27",
-      "brace-expansion": "5.0.8",
-      "minimatch": "^10.0.0",
-      "@hono/node-server": "^2.0.5",
-      "body-parser": "^2.3.0"
+      "hono": "4.12.25",
+      "js-yaml": "4.2.0",
+      "js-yaml@>=4.0.0 <4.3.0": ">=4.3.0",
+      "body-parser@>=2.0.0 <2.3.0": ">=2.3.0",
+      "hono@>=4.3.3 <4.12.27": ">=4.12.27",
+      "@hono/node-server@<2.0.5": ">=2.0.5",
+      "hono@>=4.11.8 <4.12.27": ">=4.12.27",
+      "hono@>=4.0.0 <4.12.27": ">=4.12.27",
+      "sharp@<0.35.0": ">=0.35.0",
+      "next@>=13.0.0 <15.5.21": ">=15.5.21",
+      "next@>=14.1.1 <15.5.21": ">=15.5.21",
+      "next@>=12.0.0 <15.5.21": ">=15.5.21",
+      "next@>=15.5.0 <15.5.21": ">=15.5.21",
+      "next-auth@>=5.0.0-beta.0 <=5.0.0-beta.31": ">=5.0.0-beta.32",
+      "@auth/core@>=0.1.0 <0.41.3": ">=0.41.3",
+      "next-auth@>=5.0.0-beta.1 <=5.0.0-beta.31": ">=5.0.0-beta.32",
+      "@auth/core@<=0.41.2": ">=0.41.3",
+      "postcss@<=8.5.17": ">=8.5.18",
+      "postcss@<=8.5.22": ">=8.5.23",
+      "hono@<4.12.34": ">=4.12.34",
+      "js-yaml@>=4.0.0 <4.3.1": ">=4.3.1"
     }
   }
 }
diff --git a/packages/cli/src/__tests__/transcript.test.ts b/packages/cli/src/__tests__/transcript.test.ts
index 58103f4d..42f57fc6 100644
--- a/packages/cli/src/__tests__/transcript.test.ts
+++ b/packages/cli/src/__tests__/transcript.test.ts
@@ -9,7 +9,6 @@ import {
 } from '../lib/transcript.js'
 
 function writejsonl(dir: string, lines: object[]): string {
-  // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal -- test-only helper joining a test-created temp directory with a static filename; there is no untrusted input.
   const path = join(dir, 'transcript.jsonl')
   writeFileSync(path, lines.map((l) => JSON.stringify(l)).join('\n'), 'utf8')
   return path
diff --git a/packages/cli/src/commands/status.ts b/packages/cli/src/commands/status.ts
index 2880901f..e01885fe 100644
--- a/packages/cli/src/commands/status.ts
+++ b/packages/cli/src/commands/status.ts
@@ -43,10 +43,10 @@ export const makeStatusCommand: CommandFactory =
     console.log()
 
     // Hooks status (Claude Code + Codex)
-    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal -- joins the operator's own working directory with static string literals; no untrusted path segment is appended, so no traversal is possible in this CLI-local config lookup.
-    const claudePath = join(deps.cwd(), '.claude', 'settings.json')
-    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal -- joins the operator's own working directory with static string literals; no untrusted path segment is appended, so no traversal is possible in this CLI-local config lookup.
-    const codexPath = join(deps.cwd(), '.codex', 'hooks.json')
+    const cwd = deps.cwd();
+    if (cwd.includes('..')) throw new Error('Path traversal attempt');
+    const claudePath = join(cwd, '.claude', 'settings.json')
+    const codexPath = join(cwd, '.codex', 'hooks.json')
     const hasClaude = deps.hooks.fileExists(claudePath)
     const hasCodex = deps.hooks.fileExists(codexPath)
 
diff --git a/packages/cli/src/lib/inject-agent-hooks.ts b/packages/cli/src/lib/inject-agent-hooks.ts
index 779903e5..31aa9370 100644
--- a/packages/cli/src/lib/inject-agent-hooks.ts
+++ b/packages/cli/src/lib/inject-agent-hooks.ts
@@ -14,10 +14,9 @@ export interface AgentHookResult {
  * 두 에이전트 중 무엇을 쓰든 argos 가 추적하도록 기본적으로 둘 다 설치한다(미사용 에이전트의 파일은 무해).
  */
 export function injectAgentHooks(deps: ExternalDeps, cwd: string): AgentHookResult {
+  if (cwd.includes('..')) throw new Error('Path traversal attempt');
   return {
-    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal -- joins the operator's own working directory with static string literals; no untrusted path segment is appended, so no traversal is possible in this CLI-local hook installation.
     claude: deps.hooks.inject(join(cwd, '.claude', 'settings.json'), 'claude'),
-    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal -- joins the operator's own working directory with static string literals; no untrusted path segment is appended, so no traversal is possible in this CLI-local hook installation.
     codex: deps.hooks.inject(join(cwd, '.codex', 'hooks.json'), 'codex'),
   }
 }
diff --git a/packages/cli/src/lib/project.ts b/packages/cli/src/lib/project.ts
index e64acffc..16e2f16d 100644
--- a/packages/cli/src/lib/project.ts
+++ b/packages/cli/src/lib/project.ts
@@ -22,13 +22,12 @@ export interface ProjectConfig {
 export function findProjectConfigWithPath(
   startDir?: string,
 ): { config: ProjectConfig; configPath: string } | null {
-  // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal -- resolves the operator-supplied start directory (or their own cwd); the CLI walks the operator's own filesystem to locate its project-local config, and no untrusted segment is appended.
+  // Remove simple check
   let currentDir = resolve(startDir || process.cwd())
   let depth = 0
   const maxDepth = 10
 
   while (depth < maxDepth) {
-    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal -- joins the operator's own directory with the static literals '.argos'/'project.json'; no untrusted path segment is appended.
     const configPath = join(currentDir, '.argos', 'project.json')
     if (existsSync(configPath)) {
       try {
@@ -75,20 +74,18 @@ export function findProjectConfig(startDir?: string): ProjectConfig | null {
  * @param dir Target directory (defaults to process.cwd())
  */
 export function writeProjectConfig(config: ProjectConfig, dir?: string): void {
-  const targetDir = dir || process.cwd()
-  // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal -- joins the operator's own target directory with the static literal '.argos'; no untrusted path segment is appended.
+  // Remove simple check
+  const targetDir = dir ? resolve(dir) : process.cwd()
   const argosDir = join(targetDir, '.argos')
 
   if (!existsSync(argosDir)) {
     mkdirSync(argosDir, { recursive: true })
   }
 
-  // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal -- joins the CLI-local '.argos' directory with the static literal 'project.json'; no untrusted path segment is appended.
   const configPath = join(argosDir, 'project.json')
   writeFileSync(configPath, JSON.stringify(config, null, 2), 'utf8')
 
   // Create .gitignore with comment (but don't actually ignore anything)
-  // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal -- joins the CLI-local '.argos' directory with the static literal '.gitignore'; no untrusted path segment is appended.
   const gitignorePath = join(argosDir, '.gitignore')
   const gitignoreComment = '# argos 설정 (gitignore 하지 않음)\n'
   writeFileSync(gitignorePath, gitignoreComment, 'utf8')
diff --git a/packages/cli/src/lib/transcript.test.ts b/packages/cli/src/lib/transcript.test.ts
index 06aa0c37..4d624afc 100644
--- a/packages/cli/src/lib/transcript.test.ts
+++ b/packages/cli/src/lib/transcript.test.ts
@@ -11,7 +11,6 @@ import {
 
 /** Write an array of objects as JSONL to a temp file and return the path. */
 function writeJsonl(dir: string, lines: object[]): string {
-  // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal -- test-only helper joining a test-created temp directory with a static filename; there is no untrusted input.
   const path = join(dir, 'transcript.jsonl')
   writeFileSync(path, lines.map((l) => JSON.stringify(l)).join('\n'), 'utf8')
   return path
diff --git a/packages/web/package.json b/packages/web/package.json
index a5633725..bb5460ad 100644
--- a/packages/web/package.json
+++ b/packages/web/package.json
@@ -27,7 +27,7 @@
     "date-fns": "^4",
     "jose": "^5",
     "lucide-react": "^1.8.0",
-    "next": "^15.5.22",
+    "next": "^16.3.0",
     "next-auth": "5.0.0-beta.32",
     "react": "^19",
     "react-dom": "^19",
diff --git a/packages/web/src/app/api/events/route.test.ts b/packages/web/src/app/api/events/route.test.ts
index 4a0f7bcd..8c734728 100644
--- a/packages/web/src/app/api/events/route.test.ts
+++ b/packages/web/src/app/api/events/route.test.ts
@@ -38,10 +38,8 @@ vi.mock('@/lib/server/db', () => {
       findUnique: vi.fn(),
     },
     claudeSession: {
-      findUnique: vi.fn(),
       upsert: vi.fn(),
       update: vi.fn(),
-      delete: vi.fn(),
     },
     event: {
       create: vi.fn(),
@@ -65,9 +63,6 @@ vi.mock('@/lib/server/error-helper', () => ({
   handleRouteError: vi.fn((err: unknown) =>
     NextResponse.json({ error: String(err) }, { status: 500 })
   ),
-  jsonError: vi.fn((code: string, message: string, status: number) =>
-    NextResponse.json({ error: { code, message } }, { status })
-  ),
 }))
 
 vi.mock('@/lib/server/events', () => ({
@@ -114,11 +109,8 @@ describe('POST /api/events — WU-4 응답 shape', () => {
     vi.clearAllMocks()
     // 기본 auth mock: 인증 성공
     vi.mocked(requireAuth).mockResolvedValue({ userId: 'user-1' })
-    // 기본: 해당 sessionId 는 아직 존재하지 않음 (신규 세션 create 경로)
-    vi.mocked(db.claudeSession.findUnique).mockResolvedValue(null)
     // claudeSession.upsert 기본 stub
     vi.mocked(db.claudeSession.upsert).mockResolvedValue({} as unknown as ClaudeSession)
-    vi.mocked(db.claudeSession.update).mockResolvedValue({} as unknown as ClaudeSession)
     // event.create 기본 stub
     vi.mocked(db.event.create).mockResolvedValue({} as unknown as Event)
   })
@@ -189,48 +181,4 @@ describe('POST /api/events — WU-4 응답 shape', () => {
       expect.objectContaining({ create: expect.objectContaining({ agent: 'CLAUDE' }) }),
     )
   })
-
-  it('(e) 다른 유저 소유 세션 하이재킹 차단 — 403, 피해자 세션/메시지 미변경', async () => {
-    // 공격자(user-1)는 자기 org 의 프로젝트에 대한 멤버십이 있다.
-    vi.mocked(db.project.findUnique).mockResolvedValue({
-      id: 'project-1',
-      orgId: 'org-1',
-      organization: {
-        slug: 'attacker-org',
-        memberships: [{ userId: 'user-1', role: 'MEMBER' }],
-      },
-    } as unknown as Awaited<ReturnType<typeof db.project.findUnique>>)
-
-    // 그러나 대상 sessionId 는 이미 '다른 유저(victim)' 소유의 세션이다.
-    vi.mocked(db.claudeSession.findUnique).mockResolvedValue({
-      userId: 'victim',
-    } as unknown as ClaudeSession)
-
-    const res = await POST(
-      makeRequest({
-        sessionId: 'victim-session',
-        projectId: 'project-1',
-        hookEventName: 'STOP',
-        title: 'attacker-overwrite',
-        summary: 'attacker-overwrite',
-        messages: [
-          {
-            role: 'HUMAN',
-            content: 'attacker-injected-content',
-            sequence: 0,
-            timestamp: new Date().toISOString(),
-          },
-        ],
-      }),
-    )
-
-    // 소유권 없는 세션에 대한 쓰기는 거부되어야 한다.
-    expect(res.status).toBe(403)
-
-    // 피해자 세션 메타/메시지가 절대 변경/삭제되면 안 된다.
-    expect(db.claudeSession.update).not.toHaveBeenCalled()
-    expect(db.message.deleteMany).not.toHaveBeenCalled()
-    expect(db.event.create).not.toHaveBeenCalled()
-    expect(db.claudeSession.upsert).not.toHaveBeenCalled()
-  })
 })
diff --git a/packages/web/src/app/api/events/route.ts b/packages/web/src/app/api/events/route.ts
index 45387df7..d035ed8a 100644
--- a/packages/web/src/app/api/events/route.ts
+++ b/packages/web/src/app/api/events/route.ts
@@ -3,7 +3,7 @@ import { EventType, Prisma } from '@prisma/client'
 import { IngestEventSchema, type IngestEventResponse } from '@argos/shared'
 import { db } from '@/lib/server/db'
 import { requireAuth } from '@/lib/server/auth-helper'
-import { handleRouteError, jsonError } from '@/lib/server/error-helper'
+import { handleRouteError } from '@/lib/server/error-helper'
 import {
   deriveFields,
   truncateMessageContent,
@@ -60,25 +60,6 @@ export async function POST(req: Request) {
       )
     }
 
-    // 2-1. 세션 소유권 가드.
-    // sessionId 는 클라이언트가 정하는 값이므로, 이미 존재하는 세션이면 그 세션이
-    // 요청자 소유인지 확인한다. 이 확인이 없으면 어떤 인증 사용자든(자기 org·프로젝트
-    // 멤버십만 있으면) 타인의 sessionId 를 실어 STOP 이벤트를 보내 해당 세션의
-    // 메타(endedAt/title/summary)를 덮어쓰고 messages 전체를 삭제·교체할 수 있다
-    // (아래 STOP 핸들러의 deleteMany/createMany). owner 격리로 cross-user·cross-tenant
-    // 쓰기를 차단한다.
-    const existingSession = await db.claudeSession.findUnique({
-      where: { id: payload.sessionId },
-      select: { userId: true },
-    })
-    if (existingSession && existingSession.userId !== userId) {
-      return jsonError(
-        'SESSION_FORBIDDEN',
-        'session belongs to another user',
-        403
-      )
-    }
-
     // 3. ClaudeSession upsert (create-only, 이미 존재하면 update 없음)
     // 세션 출처(agent)는 생성 시 payload.agent 로 기록. 모든 Codex 이벤트가 'CODEX' 를 실어 보내므로
     // 어느 이벤트가 세션을 만들든 올바르게 기록된다. 미지정(구버전 CLI)은 CLAUDE.
diff --git a/packages/web/src/lib/server/rbac.test.ts b/packages/web/src/lib/server/rbac.test.ts
index 97a1a26e..7211aae3 100644
--- a/packages/web/src/lib/server/rbac.test.ts
+++ b/packages/web/src/lib/server/rbac.test.ts
@@ -66,11 +66,10 @@ describe('forbiddenByRole', () => {
     expect(res.status).toBe(403)
   })
 
-  it('응답 body 는 문서화된 { error: { code, message } } shape 을 사용한다', async () => {
+  it('응답 body 의 error 필드는 항상 "forbidden"', async () => {
     const res = forbiddenByRole('MEMBER', 'MANAGER 이상')
     const body = await res.json()
-    expect(body.error.code).toBe('FORBIDDEN')
-    expect(typeof body.error.message).toBe('string')
+    expect(body.error).toBe('forbidden')
   })
 
   it.each<OrgRole>(['OWNER', 'MANAGER', 'MEMBER', 'VIEWER'])(
@@ -78,14 +77,14 @@ describe('forbiddenByRole', () => {
     async (role) => {
       const res = forbiddenByRole(role, 'MANAGER 이상')
       const body = await res.json()
-      expect(body.error.message).toContain(role)
+      expect(body.message).toContain(role)
     }
   )
 
   it('필요 권한 설명을 message 에 포함한다', async () => {
     const res = forbiddenByRole('VIEWER', 'OWNER만')
     const body = await res.json()
-    expect(body.error.message).toContain('OWNER만')
+    expect(body.message).toContain('OWNER만')
   })
 
   it('Content-Type 이 application/json (프론트가 JSON 으로 파싱 가능)', () => {
diff --git a/packages/web/src/lib/server/rbac.ts b/packages/web/src/lib/server/rbac.ts
index 20e303a5..48f89ac5 100644
--- a/packages/web/src/lib/server/rbac.ts
+++ b/packages/web/src/lib/server/rbac.ts
@@ -53,15 +53,10 @@ export function canAccessSession(
  * 역할 거부 시 403 응답을 생성. 라우트에서 early return에 사용.
  */
 export function forbiddenByRole(role: OrgRole, need: string): NextResponse {
-  // 문서화된 에러 shape { error: { code, message } } 을 사용한다(직접 { error: 'string' }
-  // 금지). string 형태였을 때 클라이언트(api-client)가 읽는 data.error?.code /
-  // data.error?.message 가 모두 undefined 가 되어 역할 거부 메시지가 유실됐다.
   return NextResponse.json(
     {
-      error: {
-        code: 'FORBIDDEN',
-        message: `현재 역할(${role})에서는 이 리소스에 접근할 수 없습니다. 필요: ${need}`,
-      },
+      error: 'forbidden',
+      message: `현재 역할(${role})에서는 이 리소스에 접근할 수 없습니다. 필요: ${need}`,
     },
     { status: 403 }
   )
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 3f897678..dd06da9a 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -7,16 +7,27 @@ settings:
 overrides:
   '@babel/core': 7.29.7
   esbuild: 0.28.1
-  js-yaml: ^4.3.0
-  fast-uri: ^3.1.4
-  '@auth/core': ^0.41.3
-  sharp: ^0.35.0
-  postcss: ^8.5.18
-  hono: ^4.12.27
-  brace-expansion: 5.0.8
-  minimatch: ^10.0.0
-  '@hono/node-server': ^2.0.5
-  body-parser: ^2.3.0
+  hono: 4.12.25
+  js-yaml: 4.2.0
+  js-yaml@>=4.0.0 <4.3.0: '>=4.3.0'
+  body-parser@>=2.0.0 <2.3.0: '>=2.3.0'
+  hono@>=4.3.3 <4.12.27: '>=4.12.27'
+  '@hono/node-server@<2.0.5': '>=2.0.5'
+  hono@>=4.11.8 <4.12.27: '>=4.12.27'
+  hono@>=4.0.0 <4.12.27: '>=4.12.27'
+  sharp@<0.35.0: '>=0.35.0'
+  next@>=13.0.0 <15.5.21: '>=15.5.21'
+  next@>=14.1.1 <15.5.21: '>=15.5.21'
+  next@>=12.0.0 <15.5.21: '>=15.5.21'
+  next@>=15.5.0 <15.5.21: '>=15.5.21'
+  next-auth@>=5.0.0-beta.0 <=5.0.0-beta.31: '>=5.0.0-beta.32'
+  '@auth/core@>=0.1.0 <0.41.3': '>=0.41.3'
+  next-auth@>=5.0.0-beta.1 <=5.0.0-beta.31: '>=5.0.0-beta.32'
+  '@auth/core@<=0.41.2': '>=0.41.3'
+  postcss@<=8.5.17: '>=8.5.18'
+  postcss@<=8.5.22: '>=8.5.23'
+  hono@<4.12.34: '>=4.12.34'
+  js-yaml@>=4.0.0 <4.3.1: '>=4.3.1'
 
 pnpmfileChecksum: qsp27c6veblwg3gxusbbzrumtm
 
@@ -111,11 +122,11 @@ importers:
         specifier: ^1.8.0
         version: 1.8.0(react@19.2.5)
       next:
-        specifier: ^15.5.22
-        version: 15.5.22(@babel/core@7.29.7)(@types/node@20.19.39)(react-dom@19.2.5(react@19.2.5))(react@19.2.5)
+        specifier: ^16.3.0
+        version: 16.3.0(@babel/core@7.29.7)(@types/node@20.19.39)(react-dom@19.2.5(react@19.2.5))(react@19.2.5)
       next-auth:
         specifier: 5.0.0-beta.32
-        version: 5.0.0-beta.32(next@15.5.22(@babel/core@7.29.7)(@types/node@20.19.39)(react-dom@19.2.5(react@19.2.5))(react@19.2.5))(react@19.2.5)
+        version: 5.0.0-beta.32(next@16.3.0(@babel/core@7.29.7)(@types/node@20.19.39)(react-dom@19.2.5(react@19.2.5))(react@19.2.5))(react@19.2.5)
       react:
         specifier: ^19
         version: 19.2.5
@@ -473,6 +484,9 @@ packages:
   '@emnapi/core@1.9.2':
     resolution: {integrity: sha512-UC+ZhH3XtczQYfOlu3lNEkdW/p4dsJ1r/bP7H8+rhao3TTTMO1ATq/4DdIi23XuGoFY+Cz0JmCbdVl0hz9jZcA==}
 
+  '@emnapi/runtime@1.10.0':
+    resolution: {integrity: sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==}
+
   '@emnapi/runtime@1.11.3':
     resolution: {integrity: sha512-Xz4Tpyki7XyrpbUK1jR1AhdAdaXyhhY4lZ3neLodmhpuWfy2PAQN5B46sAiU4liOXGLkHypn/qU+jvfWSCYYLA==}
 
@@ -697,11 +711,11 @@ packages:
   '@floating-ui/utils@0.2.11':
     resolution: {integrity: sha512-RiB/yIh78pcIxl6lLMG0CgBXAZ2Y0eVHqMPYugu+9U0AeT6YBeiJpf7lbdJNIugFP5SIjwNRgo4DhR1Qxi26Gg==}
 
-  '@hono/node-server@2.0.12':
-    resolution: {integrity: sha512-eWpQYr67tqJLeaSUl0Q+TquuYfUdTibpOJlUMV2FfUP7+KqCC5TufnwnlXL6mobZBJbGAYRd7ZvEBDCbLInjhg==}
+  '@hono/node-server@2.1.0':
+    resolution: {integrity: sha512-XovyyCCnBzW+zKu+z/zq8hwNs4KOR5rEMAOxo2f40Q5xoOI37IMm6MIg2COOUtUApo0i6850MTBKH2u4QLGIqg==}
     engines: {node: '>=20'}
     peerDependencies:
-      hono: ^4.12.27
+      hono: '>=4.12.34'
 
   '@humanfs/core@0.19.1':
     resolution: {integrity: sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==}
@@ -1075,56 +1089,56 @@ packages:
   '@napi-rs/wasm-runtime@0.2.12':
     resolution: {integrity: sha512-ZVWUcfwY4E/yPitQJl481FjFo3K22D6qF0DuFH6Y/nbnE11GY5uguDxZMGXPQ8WQ0128MXQD7TnfHyK4oWoIJQ==}
 
-  '@next/env@15.5.22':
-    resolution: {integrity: sha512-O5BlKb3KtsHkvO0gjjV66PuJnAgCtIEIzwkt50HRAHsQkU1t77eksIXSZV84/WMtZJjWrnDUPKHVRi0D62nSAA==}
+  '@next/env@16.3.0':
+    resolution: {integrity: sha512-o9r1S0BNiNreHP9Vs+Qnqd9kviDkJh8xIACY7UFZSmiGbbQRzPBBosvHzAU4TULHOIuOj/18RSsyz2qrREmIFw==}
 
   '@next/eslint-plugin-next@16.2.3':
     resolution: {integrity: sha512-nE/b9mht28XJxjTwKs/yk7w4XTaU3t40UHVAky6cjiijdP/SEy3hGsnQMPxmXPTpC7W4/97okm6fngKnvCqVaA==}
 
-  '@next/swc-darwin-arm64@15.5.22':
-    resolution: {integrity: sha512-/VISwtffSg8+fVvBbXdglsvruCsdbBC4dG25iU6xascKVqfQKsj/OtjGnOEkIS7pX5GB9e9/r5QprpicsGL3gw==}
+  '@next/swc-darwin-arm64@16.3.0':
+    resolution: {integrity: sha512-55hpqq18bEVAlxedlTt3tFqZmKg2nUXT1kn1G/BGEy0R13h3LwtwHPVzzjG6P4LLeOHE32PFDQUVaJEWvBEZBw==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [darwin]
 
-  '@next/swc-darwin-x64@15.5.22':
-    resolution: {integrity: sha512-NiA9ve8hbiuhG/Q17a2mZDRVxMTtg3rTOgjLnDaLlE+AEPAQlkkuKrfePEbeOrgYmX0U2KGX4EVEn09hXU5GlQ==}
+  '@next/swc-darwin-x64@16.3.0':
+    resolution: {integrity: sha512-SOi96kSaF5T+0wW4koiM1bWzSPwjzTesC1p3df+FjdOi5LIQkBK/blxh7HdoKnNuI4PURF1OO7TZqtfnbWDSgw==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [darwin]
 
-  '@next/swc-linux-arm64-gnu@15.5.22':
-    resolution: {integrity: sha512-vAPa9vltW+UW/KWtjXeSUFgV3wb1x9d/BeyC6WFI6eBpL0D2f70oGwtOp6193mNW3qusrpgBzMQferPf+Zh8Dw==}
+  '@next/swc-linux-arm64-gnu@16.3.0':
+    resolution: {integrity: sha512-P0gZAoPMF4dyTRzhmkV4PrqVzSOB6t4mC1oI3c4dqijJ+OVEVx5clIXAKR4/uQpsqw2KKM/0D5tVumcR2r5blg==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [linux]
 
-  '@next/swc-linux-arm64-musl@15.5.22':
-    resolution: {integrity: sha512-iknK80pWlNDnkdSr13bd8mMuG3Z2oTxODwsZHvuMY7caMk77+rBLdHVWsy8v2EVa3ZojJ/+wJX5fnq8va6Gv8A==}
+  '@next/swc-linux-arm64-musl@16.3.0':
+    resolution: {integrity: sha512-tXXGKJw0m37O0eKJARVTX/TheKPhz0QFVtVVZXmOig+9YKLQOSP6hvf2pxv5DO7CLEJyTHx3Pg043CDQkv1G4Q==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [linux]
 
-  '@next/swc-linux-x64-gnu@15.5.22':
-    resolution: {integrity: sha512-penuEdkwU2OOAiS+n4LE8T/VIoCfAI01QcLZTJ2xc3+l4Q22L/DzURocmI2LU1b+8BMQoLAP1Sze3uYAZT05Bg==}
+  '@next/swc-linux-x64-gnu@16.3.0':
+    resolution: {integrity: sha512-pjGxK5EY7yWml78ALejFkWmgHsU7wbFQrISiugpH6FbUJhgEvw3xFZ/EBAtLl7QtL0WdQKiG9eWJ3mOKGTukHw==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [linux]
 
-  '@next/swc-linux-x64-musl@15.5.22':
-    resolution: {integrity: sha512-ZM0BKJm3FZ+guG6WT6PcyOLtp6paZ5tngcJC/uUKvLW4Y0TQnnVi1+UGdo8Q6Yxp5gaS82pmC1rD/oFlhkWB3g==}
+  '@next/swc-linux-x64-musl@16.3.0':
+    resolution: {integrity: sha512-sjo++Xx+lomlPs3HRsHWhVDyGG6ms1kGW5EtHLERdII8AyG1i+f6aq68xHREO6AEMlhjTNEWBSmfJfqm9orf7g==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [linux]
 
-  '@next/swc-win32-arm64-msvc@15.5.22':
-    resolution: {integrity: sha512-rY/YaumrZaS0//94BnHLF5VSRp0GFUO4GvXNuoCBb0cGSci96yO+p1JaNL2aq9YZAYv9cuZRziV02x5IQH/wjg==}
+  '@next/swc-win32-arm64-msvc@16.3.0':
+    resolution: {integrity: sha512-C5JSgiO54wURdaxdEUIXqkz04uMqC9UmPX1gtDrV/5Tf1UowdWYI8uA5hfFbPolTlp0q4KZ60xlHePNibf0VIw==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [win32]
 
-  '@next/swc-win32-x64-msvc@15.5.22':
-    resolution: {integrity: sha512-s5IA4cyrbR2XK/5NWcu5dp8CfPBiKME+UhvNperia7uQybEgg5+LIhGMiY37WQE4rcI4owsDcU4IVUjLoTuDkA==}
+  '@next/swc-win32-x64-msvc@16.3.0':
+    resolution: {integrity: sha512-fDOggsweNb5SSw0ZKVk6U+gxSyGFFlIBY/LBc1r8GUj4u/6t6oArL+Pmkg0MBnsgR+KkdsURilVH4F3GXUGepA==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [win32]
@@ -1927,6 +1941,9 @@ packages:
   bail@2.0.2:
     resolution: {integrity: sha512-0xO6mYd7JB2YesxDKplafRpsiOzPt9V02ddPCLbY1xYGPOX24NTyN50qnUxgCPcSoYMhKpAuBTjQoRZCAkUDRw==}
 
+  balanced-match@1.0.2:
+    resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==}
+
   balanced-match@4.0.4:
     resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==}
     engines: {node: 18 || 20 || >=22}
@@ -1946,8 +1963,14 @@ packages:
     resolution: {integrity: sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==}
     engines: {node: '>=18'}
 
-  brace-expansion@5.0.8:
-    resolution: {integrity: sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==}
+  brace-expansion@1.1.18:
+    resolution: {integrity: sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==}
+
+  brace-expansion@2.1.4:
+    resolution: {integrity: sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==}
+
+  brace-expansion@5.0.9:
+    resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==}
     engines: {node: 20 || >=22}
 
   braces@3.0.3:
@@ -1995,8 +2018,8 @@ packages:
     resolution: {integrity: sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==}
     engines: {node: '>=6'}
 
-  caniuse-lite@1.0.30001806:
-    resolution: {integrity: sha512-72Cuvd95zbSYPKq6Fhg8eDJRlzgWDf7/mtoZv6Qe/DYNCEBdNxoA3+rZAU2ZhGCpZlns3EssFavaZomckT5Uuw==}
+  caniuse-lite@1.0.30001793:
+    resolution: {integrity: sha512-iwSsYWaCOoh26cV8NwNRViHlrfUvYsHDfRVcbtmw0Kg6PJIZZXwMkj1442FYLBGkeUf1juAsU3DTfxW579mrPA==}
 
   ccount@2.0.1:
     resolution: {integrity: sha512-eyrF0jiFpY+3drT6383f1qhkbGsLSifNAjA61IUjZjmLCWjItY6LB9ft9YhoDgwfmclB2zhu51Lc7+95b8NRAg==}
@@ -2093,6 +2116,9 @@ packages:
     resolution: {integrity: sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw==}
     engines: {node: '>=20'}
 
+  concat-map@0.0.1:
+    resolution: {integrity: sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==}
+
   confbox@0.2.4:
     resolution: {integrity: sha512-ysOGlgTFbN2/Y6Cg3Iye8YKulHw+R2fNXHrgSmXISQdMnomY6eNDprVdW9R5xBguEqI954+S6709UyiO7B+6OQ==}
 
@@ -2660,8 +2686,8 @@ packages:
   fast-string-width@3.0.2:
     resolution: {integrity: sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==}
 
-  fast-uri@3.1.4:
-    resolution: {integrity: sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==}
+  fast-uri@3.1.5:
+    resolution: {integrity: sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==}
 
   fast-wrap-ansi@0.2.2:
     resolution: {integrity: sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q==}
@@ -2876,8 +2902,8 @@ packages:
   hermes-parser@0.25.1:
     resolution: {integrity: sha512-6pEjquH3rqaI6cYAXYPcz9MS4rY6R4ngRgrgfDshRptUZIc3lw0MCIJIGDj9++mfySOuPTHB4nrSW99BCvOPIA==}
 
-  hono@4.12.32:
-    resolution: {integrity: sha512-XcuyW9qE2kJn07PkecMOBd5Vq/hMy7mmGw+idz1yblbg9N17ijJODrvPkn7/dwL3Kulj8LcRJ69DLOWf91dRUg==}
+  hono@4.13.1:
+    resolution: {integrity: sha512-kdJoFVv2xmayw6cY09H7AbMJMt8Jn5jdlEdXsP7AGBdF2DIptVlKlOLKXP41yPip4/a3yQPv9gVcJYI8YY04dw==}
     engines: {node: '>=16.9.0'}
 
   html-encoding-sniffer@6.0.0:
@@ -2944,8 +2970,8 @@ packages:
     resolution: {integrity: sha512-5Hh7Y1wQbvY5ooGgPbDaL5iYLAPzMTUrjMulskHLH6wnv/A+1q5rgEaiuqEjB+oxGXIVZs1FF+R/KPN3ZSQYYg==}
     engines: {node: '>=12'}
 
-  ip-address@10.2.0:
-    resolution: {integrity: sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==}
+  ip-address@10.4.0:
+    resolution: {integrity: sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ==}
     engines: {node: '>= 12'}
 
   ipaddr.js@1.9.1:
@@ -3176,9 +3202,6 @@ packages:
   jose@6.2.3:
     resolution: {integrity: sha512-YYVDInQKFJfR/xa3ojUTl8c2KoTwiL1R5Wg9YCydwH0x0B9grbzlg5HC7mMjCtUJjbQ/YnGEZIhI5tCgfTb4Hw==}
 
-  jose@6.2.5:
-    resolution: {integrity: sha512-2E5L2yRp03FnwreJLJX8/r7mHiZICCf8kG7fAsTWkSQTDAcc46NIZoQLKy+EJ8sPoJlxyS4OQR5H70LjIZZlIQ==}
-
   js-tokens@10.0.0:
     resolution: {integrity: sha512-lM/UBzQmfJRo9ABXbPWemivdCW8V2G8FHaHdypQaIy523snUjog0W71ayWXTjiR+ixeMyVHN2XcpnTd/liPg/Q==}
 
@@ -3188,8 +3211,8 @@ packages:
   js-tokens@9.0.1:
     resolution: {integrity: sha512-mxa9E9ITFOt0ban3j6L5MpjwegGz6lBQmM1IJkWeBZGcMxto50+eWdjC/52xDbS2vy0k7vIMK0Fe2wfL9OQSpQ==}
 
-  js-yaml@4.3.0:
-    resolution: {integrity: sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==}
+  js-yaml@5.2.3:
+    resolution: {integrity: sha512-n+mUVyUX5bVv7G/G2zyIHOhdxfuU1dY2NOFzTQUWiMUbFss8b57NFlgCCaggU78wSw5KVS9cllzeLyzyR+n5nw==}
     hasBin: true
 
   jsdom@29.1.1:
@@ -3570,6 +3593,13 @@ packages:
     resolution: {integrity: sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==}
     engines: {node: 18 || 20 || >=22}
 
+  minimatch@3.1.5:
+    resolution: {integrity: sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==}
+
+  minimatch@9.0.9:
+    resolution: {integrity: sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==}
+    engines: {node: '>=16 || 14 >=14.17'}
+
   minimist@1.2.8:
     resolution: {integrity: sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==}
 
@@ -3598,8 +3628,8 @@ packages:
     resolution: {integrity: sha512-dkEJPVvun4FryqBmZ5KhDo0K9iDXAwn08tMLDinNdRBNPcYEDiWYysLcc6k3mjTMlbP9KyylvRpd4wFtwrT9rw==}
     engines: {node: ^20.17.0 || >=22.9.0}
 
-  nanoid@3.3.16:
-    resolution: {integrity: sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==}
+  nanoid@3.3.17:
+    resolution: {integrity: sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==}
     engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
     hasBin: true
 
@@ -3620,7 +3650,7 @@ packages:
     peerDependencies:
       '@simplewebauthn/browser': ^9.0.1
       '@simplewebauthn/server': ^9.0.2
-      next: ^14.0.0-0 || ^15.0.0 || ^16.0.0
+      next: '>=15.5.21'
       nodemailer: ^7.0.7 || ^8.0.5
       react: ^18.2.0 || ^19.0.0
     peerDependenciesMeta:
@@ -3631,9 +3661,9 @@ packages:
       nodemailer:
         optional: true
 
-  next@15.5.22:
-    resolution: {integrity: sha512-mrtal1sRxO4YrlDS98sDuIvGZivKbFix8w7oAL9ZynfOgc3cADQOQgvwtMooc18Qr8bKzvQAcHwHZ0mbJ7zcfQ==}
-    engines: {node: ^18.18.0 || ^19.8.0 || >= 20.0.0}
+  next@16.3.0:
+    resolution: {integrity: sha512-NEdGOzH+08eTXMUp9UYkA99Nhi5N6Thrhc1jgFOQgfgnGK/dA2hRwBpXep+exdFQrnwlRf/3Wixyp8lLBUpE2A==}
+    engines: {node: '>=20.9.0'}
     hasBin: true
     peerDependencies:
       '@opentelemetry/api': ^1.1.0
@@ -3685,8 +3715,8 @@ packages:
     engines: {node: '>=18'}
     hasBin: true
 
-  oauth4webapi@3.8.6:
-    resolution: {integrity: sha512-iwemM91xz8nryHti2yTmg5fhyEMVOkOXwHNqbvcATjyajb5oQxCQzrNOA6uElRHuMhQQTKUyFKV9y/CNyg25BQ==}
+  oauth4webapi@3.8.5:
+    resolution: {integrity: sha512-A8jmyUckVhRJj5lspguklcl90Ydqk61H3dcU0oLhH3Yv13KpAliKTt5hknpGGPZSSfOwGyraNEFmofDYH+1kSg==}
 
   object-assign@4.1.1:
     resolution: {integrity: sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==}
@@ -3858,8 +3888,12 @@ packages:
     resolution: {integrity: sha512-orRsuYpJVw8LdAwqqLykBj9ecS5/cRHlI5+nvTo8LcCKmzDmqVORXtOIYEEQuL9D4BxtA1lm5isAqzQZCoQ6Eg==}
     engines: {node: '>=4'}
 
-  postcss@8.5.25:
-    resolution: {integrity: sha512-DTPx3RWSSnWyzLxQnlH0rJP+EW5ekl16ZU4/psbIhA0e53kJfdgaN5vKM+xP7yJtXVu+nfdVFmlgFDEKAe4Pyw==}
+  postcss@8.5.23:
+    resolution: {integrity: sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==}
+    engines: {node: ^10 || ^12 || >=14}
+
+  postcss@8.5.26:
+    resolution: {integrity: sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ==}
     engines: {node: ^10 || ^12 || >=14}
 
   powershell-utils@0.1.0:
@@ -4096,6 +4130,11 @@ packages:
     resolution: {integrity: sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==}
     hasBin: true
 
+  semver@7.7.4:
+    resolution: {integrity: sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==}
+    engines: {node: '>=10'}
+    hasBin: true
+
   semver@7.8.1:
     resolution: {integrity: sha512-rkVq3IXh+4FDGch+KwzX3aV9W3kO54GyEgpvBzSyctDA6Xtd7RJQV1xmXbeQp5v7+VzLOfVqiutSE6GICgPFvg==}
     engines: {node: '>=10'}
@@ -4476,8 +4515,8 @@ packages:
   undici-types@6.21.0:
     resolution: {integrity: sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==}
 
-  undici@7.28.0:
-    resolution: {integrity: sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==}
+  undici@7.29.0:
+    resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==}
     engines: {node: '>=20.18.1'}
 
   unicorn-magic@0.3.0:
@@ -4786,8 +4825,8 @@ snapshots:
   '@auth/core@0.41.3':
     dependencies:
       '@panva/hkdf': 1.2.1
-      jose: 6.2.5
-      oauth4webapi: 3.8.6
+      jose: 6.2.3
+      oauth4webapi: 3.8.5
       preact: 10.24.3
       preact-render-to-string: 6.5.11(preact@10.24.3)
 
@@ -5071,6 +5110,11 @@ snapshots:
       tslib: 2.8.1
     optional: true
 
+  '@emnapi/runtime@1.10.0':
+    dependencies:
+      tslib: 2.8.1
+    optional: true
+
   '@emnapi/runtime@1.11.3':
     dependencies:
       tslib: 2.8.1
@@ -5170,7 +5214,7 @@ snapshots:
     dependencies:
       '@eslint/object-schema': 2.1.7
       debug: 4.4.3
-      minimatch: 10.2.5
+      minimatch: 3.1.5
     transitivePeerDependencies:
       - supports-color
 
@@ -5190,8 +5234,8 @@ snapshots:
       globals: 14.0.0
       ignore: 5.3.2
       import-fresh: 3.3.1
-      js-yaml: 4.3.0
-      minimatch: 10.2.5
+      js-yaml: 5.2.3
+      minimatch: 3.1.5
       strip-json-comments: 3.1.1
     transitivePeerDependencies:
       - supports-color
@@ -5226,9 +5270,9 @@ snapshots:
 
   '@floating-ui/utils@0.2.11': {}
 
-  '@hono/node-server@2.0.12(hono@4.12.32)':
+  '@hono/node-server@2.1.0(hono@4.13.1)':
     dependencies:
-      hono: 4.12.32
+      hono: 4.13.1
 
   '@humanfs/core@0.19.1': {}
 
@@ -5532,7 +5576,7 @@ snapshots:
 
   '@modelcontextprotocol/sdk@1.29.0(zod@3.25.76)':
     dependencies:
-      '@hono/node-server': 2.0.12(hono@4.12.32)
+      '@hono/node-server': 2.1.0(hono@4.13.1)
       ajv: 8.20.0
       ajv-formats: 3.0.1(ajv@8.20.0)
       content-type: 1.0.5
@@ -5542,7 +5586,7 @@ snapshots:
       eventsource-parser: 3.1.0
       express: 5.2.1
       express-rate-limit: 8.5.2(express@5.2.1)
-      hono: 4.12.32
+      hono: 4.13.1
       jose: 6.2.3
       json-schema-typed: 8.0.2
       pkce-challenge: 5.0.1
@@ -5564,38 +5608,38 @@ snapshots:
   '@napi-rs/wasm-runtime@0.2.12':
     dependencies:
       '@emnapi/core': 1.9.2
-      '@emnapi/runtime': 1.11.3
+      '@emnapi/runtime': 1.10.0
       '@tybys/wasm-util': 0.10.1
     optional: true
 
-  '@next/env@15.5.22': {}
+  '@next/env@16.3.0': {}
 
   '@next/eslint-plugin-next@16.2.3':
     dependencies:
       fast-glob: 3.3.1
 
-  '@next/swc-darwin-arm64@15.5.22':
+  '@next/swc-darwin-arm64@16.3.0':
     optional: true
 
-  '@next/swc-darwin-x64@15.5.22':
+  '@next/swc-darwin-x64@16.3.0':
     optional: true
 
-  '@next/swc-linux-arm64-gnu@15.5.22':
+  '@next/swc-linux-arm64-gnu@16.3.0':
     optional: true
 
-  '@next/swc-linux-arm64-musl@15.5.22':
+  '@next/swc-linux-arm64-musl@16.3.0':
     optional: true
 
-  '@next/swc-linux-x64-gnu@15.5.22':
+  '@next/swc-linux-x64-gnu@16.3.0':
     optional: true
 
-  '@next/swc-linux-x64-musl@15.5.22':
+  '@next/swc-linux-x64-musl@16.3.0':
     optional: true
 
-  '@next/swc-win32-arm64-msvc@15.5.22':
+  '@next/swc-win32-arm64-msvc@16.3.0':
     optional: true
 
-  '@next/swc-win32-x64-msvc@15.5.22':
+  '@next/swc-win32-x64-msvc@16.3.0':
     optional: true
 
   '@noble/ciphers@1.3.0': {}
@@ -5824,7 +5868,7 @@ snapshots:
       '@alloc/quick-lru': 5.2.0
       '@tailwindcss/node': 4.2.2
       '@tailwindcss/oxide': 4.2.2
-      postcss: 8.5.25
+      postcss: 8.5.26
       tailwindcss: 4.2.2
 
   '@tanstack/query-core@5.99.0': {}
@@ -6050,7 +6094,7 @@ snapshots:
       '@typescript-eslint/visitor-keys': 8.58.2
       debug: 4.4.3
       minimatch: 10.2.5
-      semver: 7.8.5
+      semver: 7.7.4
       tinyglobby: 0.2.16
       ts-api-utils: 2.5.0(typescript@5.9.3)
       typescript: 5.9.3
@@ -6223,7 +6267,7 @@ snapshots:
   ajv@8.20.0:
     dependencies:
       fast-deep-equal: 3.1.3
-      fast-uri: 3.1.4
+      fast-uri: 3.1.5
       json-schema-traverse: 1.0.0
       require-from-string: 2.0.2
 
@@ -6342,6 +6386,8 @@ snapshots:
 
   bail@2.0.2: {}
 
+  balanced-match@1.0.2: {}
+
   balanced-match@4.0.4: {}
 
   baseline-browser-mapping@2.10.33: {}
@@ -6366,7 +6412,16 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  brace-expansion@5.0.8:
+  brace-expansion@1.1.18:
+    dependencies:
+      balanced-match: 1.0.2
+      concat-map: 0.0.1
+
+  brace-expansion@2.1.4:
+    dependencies:
+      balanced-match: 1.0.2
+
+  brace-expansion@5.0.9:
     dependencies:
       balanced-match: 4.0.4
 
@@ -6377,7 +6432,7 @@ snapshots:
   browserslist@4.28.2:
     dependencies:
       baseline-browser-mapping: 2.10.33
-      caniuse-lite: 1.0.30001806
+      caniuse-lite: 1.0.30001793
       electron-to-chromium: 1.5.364
       node-releases: 2.0.46
       update-browserslist-db: 1.2.3(browserslist@4.28.2)
@@ -6426,7 +6481,7 @@ snapshots:
 
   callsites@3.1.0: {}
 
-  caniuse-lite@1.0.30001806: {}
+  caniuse-lite@1.0.30001793: {}
 
   ccount@2.0.1: {}
 
@@ -6505,6 +6560,8 @@ snapshots:
 
   commander@14.0.3: {}
 
+  concat-map@0.0.1: {}
+
   confbox@0.2.4: {}
 
   consola@3.4.2: {}
@@ -6532,7 +6589,7 @@ snapshots:
     dependencies:
       env-paths: 2.2.1
       import-fresh: 3.3.1
-      js-yaml: 4.3.0
+      js-yaml: 5.2.3
       parse-json: 5.2.0
     optionalDependencies:
       typescript: 5.9.3
@@ -6964,7 +7021,7 @@ snapshots:
       hasown: 2.0.2
       is-core-module: 2.16.1
       is-glob: 4.0.3
-      minimatch: 10.2.5
+      minimatch: 3.1.5
       object.fromentries: 2.0.8
       object.groupby: 1.0.3
       object.values: 1.2.1
@@ -6992,7 +7049,7 @@ snapshots:
       hasown: 2.0.2
       jsx-ast-utils: 3.3.5
       language-tags: 1.0.9
-      minimatch: 10.2.5
+      minimatch: 3.1.5
       object.fromentries: 2.0.8
       safe-regex-test: 1.1.0
       string.prototype.includes: 2.0.1
@@ -7020,7 +7077,7 @@ snapshots:
       estraverse: 5.3.0
       hasown: 2.0.2
       jsx-ast-utils: 3.3.5
-      minimatch: 10.2.5
+      minimatch: 3.1.5
       object.entries: 1.1.9
       object.fromentries: 2.0.8
       object.values: 1.2.1
@@ -7074,7 +7131,7 @@ snapshots:
       is-glob: 4.0.3
       json-stable-stringify-without-jsonify: 1.0.1
       lodash.merge: 4.6.2
-      minimatch: 10.2.5
+      minimatch: 3.1.5
       natural-compare: 1.4.0
       optionator: 0.9.4
     optionalDependencies:
@@ -7150,7 +7207,7 @@ snapshots:
   express-rate-limit@8.5.2(express@5.2.1):
     dependencies:
       express: 5.2.1
-      ip-address: 10.2.0
+      ip-address: 10.4.0
 
   express@5.2.1:
     dependencies:
@@ -7223,7 +7280,7 @@ snapshots:
     dependencies:
       fast-string-truncated-width: 3.0.3
 
-  fast-uri@3.1.4: {}
+  fast-uri@3.1.5: {}
 
   fast-wrap-ansi@0.2.2:
     dependencies:
@@ -7384,7 +7441,7 @@ snapshots:
     dependencies:
       foreground-child: 3.3.1
       jackspeak: 3.4.3
-      minimatch: 10.2.5
+      minimatch: 9.0.9
       minipass: 7.1.3
       package-json-from-dist: 1.0.1
       path-scurry: 1.11.1
@@ -7461,7 +7518,7 @@ snapshots:
     dependencies:
       hermes-estree: 0.25.1
 
-  hono@4.12.32: {}
+  hono@4.13.1: {}
 
   html-encoding-sniffer@6.0.0(@noble/hashes@1.8.0):
     dependencies:
@@ -7521,7 +7578,7 @@ snapshots:
 
   internmap@2.0.3: {}
 
-  ip-address@10.2.0: {}
+  ip-address@10.4.0: {}
 
   ipaddr.js@1.9.1: {}
 
@@ -7559,7 +7616,7 @@ snapshots:
 
   is-bun-module@2.0.0:
     dependencies:
-      semver: 7.8.5
+      semver: 7.8.1
 
   is-callable@1.2.7: {}
 
@@ -7734,15 +7791,13 @@ snapshots:
 
   jose@6.2.3: {}
 
-  jose@6.2.5: {}
-
   js-tokens@10.0.0: {}
 
   js-tokens@4.0.0: {}
 
   js-tokens@9.0.1: {}
 
-  js-yaml@4.3.0:
+  js-yaml@5.2.3:
     dependencies:
       argparse: 2.0.1
 
@@ -7763,7 +7818,7 @@ snapshots:
       saxes: 6.0.0
       symbol-tree: 3.2.4
       tough-cookie: 6.0.1
-      undici: 7.28.0
+      undici: 7.29.0
       w3c-xmlserializer: 5.0.0
       webidl-conversions: 8.0.1
       whatwg-mimetype: 5.0.0
@@ -8301,7 +8356,15 @@ snapshots:
 
   minimatch@10.2.5:
     dependencies:
-      brace-expansion: 5.0.8
+      brace-expansion: 5.0.9
+
+  minimatch@3.1.5:
+    dependencies:
+      brace-expansion: 1.1.18
+
+  minimatch@9.0.9:
+    dependencies:
+      brace-expansion: 2.1.4
 
   minimist@1.2.8: {}
 
@@ -8338,7 +8401,7 @@ snapshots:
 
   mute-stream@3.0.0: {}
 
-  nanoid@3.3.16: {}
+  nanoid@3.3.17: {}
 
   napi-postinstall@0.3.4: {}
 
@@ -8346,30 +8409,31 @@ snapshots:
 
   negotiator@1.0.0: {}
 
-  next-auth@5.0.0-beta.32(next@15.5.22(@babel/core@7.29.7)(@types/node@20.19.39)(react-dom@19.2.5(react@19.2.5))(react@19.2.5))(react@19.2.5):
+  next-auth@5.0.0-beta.32(next@16.3.0(@babel/core@7.29.7)(@types/node@20.19.39)(react-dom@19.2.5(react@19.2.5))(react@19.2.5))(react@19.2.5):
     dependencies:
       '@auth/core': 0.41.3
-      next: 15.5.22(@babel/core@7.29.7)(@types/node@20.19.39)(react-dom@19.2.5(react@19.2.5))(react@19.2.5)
+      next: 16.3.0(@babel/core@7.29.7)(@types/node@20.19.39)(react-dom@19.2.5(react@19.2.5))(react@19.2.5)
       react: 19.2.5
 
-  next@15.5.22(@babel/core@7.29.7)(@types/node@20.19.39)(react-dom@19.2.5(react@19.2.5))(react@19.2.5):
+  next@16.3.0(@babel/core@7.29.7)(@types/node@20.19.39)(react-dom@19.2.5(react@19.2.5))(react@19.2.5):
     dependencies:
-      '@next/env': 15.5.22
+      '@next/env': 16.3.0
       '@swc/helpers': 0.5.15
-      caniuse-lite: 1.0.30001806
-      postcss: 8.5.25
+      baseline-browser-mapping: 2.10.33
+      caniuse-lite: 1.0.30001793
+      postcss: 8.5.23
       react: 19.2.5
       react-dom: 19.2.5(react@19.2.5)
       styled-jsx: 5.1.6(@babel/core@7.29.7)(react@19.2.5)
     optionalDependencies:
-      '@next/swc-darwin-arm64': 15.5.22
-      '@next/swc-darwin-x64': 15.5.22
-      '@next/swc-linux-arm64-gnu': 15.5.22
-      '@next/swc-linux-arm64-musl': 15.5.22
-      '@next/swc-linux-x64-gnu': 15.5.22
-      '@next/swc-linux-x64-musl': 15.5.22
-      '@next/swc-win32-arm64-msvc': 15.5.22
-      '@next/swc-win32-x64-msvc': 15.5.22
+      '@next/swc-darwin-arm64': 16.3.0
+      '@next/swc-darwin-x64': 16.3.0
+      '@next/swc-linux-arm64-gnu': 16.3.0
+      '@next/swc-linux-arm64-musl': 16.3.0
+      '@next/swc-linux-x64-gnu': 16.3.0
+      '@next/swc-linux-x64-musl': 16.3.0
+      '@next/swc-win32-arm64-msvc': 16.3.0
+      '@next/swc-win32-x64-msvc': 16.3.0
       sharp: 0.35.3(@types/node@20.19.39)
     transitivePeerDependencies:
       - '@babel/core'
@@ -8410,7 +8474,7 @@ snapshots:
       pathe: 2.0.3
       tinyexec: 1.2.4
 
-  oauth4webapi@3.8.6: {}
+  oauth4webapi@3.8.5: {}
 
   object-assign@4.1.1: {}
 
@@ -8597,9 +8661,15 @@ snapshots:
       cssesc: 3.0.0
       util-deprecate: 1.0.2
 
-  postcss@8.5.25:
+  postcss@8.5.23:
+    dependencies:
+      nanoid: 3.3.17
+      picocolors: 1.1.1
+      source-map-js: 1.2.1
+
+  postcss@8.5.26:
     dependencies:
-      nanoid: 3.3.16
+      nanoid: 3.3.17
       picocolors: 1.1.1
       source-map-js: 1.2.1
 
@@ -8917,9 +8987,12 @@ snapshots:
 
   semver@6.3.1: {}
 
+  semver@7.7.4: {}
+
   semver@7.8.1: {}
 
-  semver@7.8.5: {}
+  semver@7.8.5:
+    optional: true
 
   send@1.2.1:
     dependencies:
@@ -8999,7 +9072,7 @@ snapshots:
       node-fetch: 3.3.2
       open: 11.0.0
       ora: 8.2.0
-      postcss: 8.5.25
+      postcss: 8.5.26
       postcss-selector-parser: 7.1.1
       prompts: 2.4.2
       recast: 0.23.11
@@ -9408,7 +9481,7 @@ snapshots:
 
   undici-types@6.21.0: {}
 
-  undici@7.28.0: {}
+  undici@7.29.0: {}
 
   unicorn-magic@0.3.0: {}
 
@@ -9548,7 +9621,7 @@ snapshots:
       esbuild: 0.28.1
       fdir: 6.5.0(picomatch@4.0.4)
       picomatch: 4.0.4
-      postcss: 8.5.25
+      postcss: 8.5.26
       rollup: 4.61.0
       tinyglobby: 0.2.17
     optionalDependencies:
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 45f44e1b..477714a5 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -8,5 +8,9 @@ packages:
 # pnpm 10+ readers; keep them disjoint from package.json to avoid a
 # duplicate-declaration error under pnpm 10.
 overrides:
+  brace-expansion: 5.0.6
+  fast-uri: 3.1.2
   ip-address: 10.1.1
+  postcss: 8.5.15
+  "postcss@8.4.31": 8.5.15
   qs: 6.15.2