fix(deps): security overrides rebased onto Next 16 (sharp + transitive)

Re-applies the #112/#113 override set against the Next 16 / React 19 tree and
adds the coverage the framework upgrade newly required. Clears every
production-relevant Dependabot alert.

- postcss 8.4.35 → 8.5.10 (+ "postcss": "$postcss" self-override)
- overrides: protobufjs ^7.6.5, ws ^8.21.1, handlebars ^4.7.9, flatted ^3.4.2,
  fast-xml-parser ^5.7.0, @babel/core ^7.29.6, yaml ^2.8.3, and version-scoped
  picomatch/minimatch/js-yaml keys
- NEW: sharp ^0.35.3 — Next 16 + @xenova/transformers pulled sharp <0.35
  (libvips CVE-2026-33327/33328/35590/35591); the botsmann overrides never
  covered it. Clears the sharp/transformers/next cascade.

npm audit: 46 → 28, and the 28 are a SINGLE advisory (brace-expansion
GHSA-mh99-v99m-4gvg, "unbounded expansion length" DoS) cascading only through
DEV tooling (jest, eslint, eslint-config-next's plugins). It is NOT fixable
here: the only patched version (5.0.8) breaks eslint 9's @eslint/config-array,
and eslint 10 (which would fix it) breaks eslint-config-next 16's bundled
eslint-plugin-react. Zero runtime/shipped exposure; input is our own file
globs, not attacker-controlled. Unblocks when eslint-config-next supports
eslint 10 or the jest/eslint 9 lines adopt patched brace-expansion.

Verified: eslint ., tsc --noEmit, next build (Turbopack), jest 227 pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: catomean