chore: patch security dependencies

Upgrade Next.js and release tooling to patched versions.

Pin secure transitive overrides for axios, undici, mermaid, tar, hono, flatted, and lodash-es.

Lock @streamdown/mermaid to 1.0.1 to preserve test compatibility while keeping mermaid patched.

Author: 郭浩

apps/site/package.json

@@ -20,7 +20,7 @@
     "fumadocs-mdx": "^11",
     "fumadocs-ui": "^15",
     "lucide-react": "^0.563.0",
-    "next": "15.3.6",
+    "next": "15.5.14",
     "react": "^19",
     "react-dom": "^19",
     "shadcn": "^4.0.2",