fix(security): bump @auth/pg-adapter so @auth/core reaches patched 0.41.3

[catomean]

Why

#260 (next-auth → beta.32) cleared the next-auth advisories but left one critical open, because the vulnerable package survived one level down:

node_modules/@auth/core                    0.41.2   <- vulnerable, HOISTED
node_modules/@auth/pg-adapter              1.11.2   <- depends on EXACTLY 0.41.2
node_modules/next-auth/node_modules/@auth/core  0.41.3   <- patched, but nested

next-auth@beta.32 carries its own patched nested copy, so the advisory looked half-fixed — but @auth/pg-adapter@1.11.2 pins @auth/core to exactly 0.41.2, and that copy is the one hoisted to the top of node_modules.

@auth/pg-adapter@1.11.3 requires 0.41.3, which collapses the tree to a single patched copy.

Advisories cleared

Severity	Advisory
critical	Email normalizer validates the address before Unicode normalisation
high	getToken() throws an uncaught exception on a malformed Bearer header
medium	OAuth state/nonce/PKCE check cookies not bound to the transaction

This takes the repo's open Dependabot alerts from 10 (3 critical) → 3, with zero critical remaining.

Verification

• Lockfile now contains exactly one @auth/core, at 0.41.3 — the duplicate nested copy is gone.
• npm run typecheck — clean (0 errors), which matters here because the adapter implements the Adapter interface from @auth/core.
• Diff is 2 files, and the lock diff is a net removal (6 packages dropped).
• Auth smoke on prod after deps: bump next-auth from 5.0.0-beta.31 to 5.0.0-beta.32 #260 deployed: /api/auth/providers and /api/auth/csrf both 200.

🤖 Generated with Claude Code