Bump Next.js from 16.2.6 to 16.3.3 in /site

[dependabot]

Bumps next from 16.2.6 to 16.2.11.

Release notes

Sourced from next's releases.

v16.2.11

This release contains security fixes for the following advisories:

High:

• Denial of Service in App Router using Server Actions
• Middleware / Proxy bypass in App Router applications using Turbopack and single locale
• Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
• Server-Side Request Forgery in Server Actions on custom servers

Moderate:

• Cache confusion of response bodies for requests with bodies
• Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
• Denial of Service in the Image Optimization API using SVGs
• Unauthenticated disclosure of internal Server Function endpoints
• Unbounded Server Action payload in Edge runtime

v16.2.10

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 16.2.4.

Commits

• 9beca08 v16.2.11
• 3c48c7a [16.x] Fix Turbopack middleware matcher with i18n single locale
• ac1eff3 [16.x] Improve performance of checking valid MPA form submissions
• 9a4651e [16.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
• b512063 [16.x] Set correct origin for internal redirects in custom server
• d303326 [16.x] Ensure exotic rewrite param values are properly encoded
• 73b9487 [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request
• bf9d17f [16.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies
• fe28768 [16.x] fix(next/image): improve performance of detectContentType()
• d8afb8d [16.x] Performance improvements when decoding React Server function payloads
• Additional commits viewable in compare view

[0thernet]

Cleanup recovery: the original manifest-only Next.js 16.2.11 update failed the frozen site install and was superseded by the current stable 16.3.3 security release, published with two critical unauthenticated RCE fixes. After Dependabot concurrently rebased the branch to ac75b0c, the recovery was replayed as descendant b8a64b6 without rewriting that work. The head aligns next and eslint-config-next at 16.3.3 and commits the Bun 1.3.14 lockfile. Local frozen install, site lint/build/runtime tests, full 73-test repository check, generated-tree reproducibility, and package inspection passed. CI run https://github.com/hraness/oh/actions/runs/33076249534 passed on synthetic merge 1b99990 from current main 24f5226 and the exact recovery head. The source branch remains retained.