chore(deps): upgrade Next.js 14 → 15.5.21 (clears 15 Dependabot alerts)

[catomean]

What

Upgrades Next.js 14.2.35 → 15.5.21 (and eslint-config-next to match). React stays on 18 — Next 15 supports react ^18.2.0, so no forced React 19 migration.

Why Next 15, not 16

All 15 open next-related Dependabot alerts (4 high, incl. Server-Components DoS, Pages-Router middleware bypass, SSRF, image-optimizer DoS) are patched at 15.5.16. Jumping to Next 16 would force React 19 + Turbopack-default for zero additional security benefit — pure added risk. This is the smallest correct change that closes the alerts.

Breaking-change migration (Next 15)

Change	What was done
Async request APIs	params / searchParams are now Promises — awaited in the 6 dynamic pages that consume them as props (blog/[slug], knowledge/guides/[slug], knowledge/guides, professionals/[slug], governance employees/[id] + agencies/[id] via React.use() since they're client components)
cookies() now async	createRouteHandlerClient() became async; all 9 call sites now await it
next.config	experimental.serverComponentsExternalPackages → top-level serverExternalPackages (renamed in 15)
typedRoutes tightening	object href={{ pathname, hash }} no longer typechecks → string href="/path#hash" (4 governance pages)
eslint	ignore the Next-generated next-env.d.ts (Next 15 adds a routes.d.ts triple-slash reference that trips no-triple-slash-reference in raw eslint / lint-staged)

Client components using the useParams() hook are unaffected and left untouched.

Verification

• ✅ next build green — compiles, type-checks, lints, prerenders all 81 pages (including every migrated dynamic route)
• ✅ tsc clean on all changed files (one pre-existing Set-iteration error in a test file remains — it fails on main too and is not in the build graph / CI gate)
• ✅ lint-staged (eslint + prettier) passes

Notes / out of scope

• Pre-existing: prepare script uses husky-v8 syntax (husky install) while the dep is husky v9 — runs with a deprecation warning only, non-blocking. Worth a follow-up cleanup.
• The remaining Dependabot tail on this repo (@xenova/transformers ML chain incl. the critical protobufjs) is a separate breaking migration.

🤖 Generated with Claude Code