chore(deps): refresh backend lock + frontend deps; Node 22 builder

- uv lock --upgrade: langchain 1.3.11, fastapi 0.139 (starlette 1.3.1),
uvicorn 0.50.2, anthropic 0.116, etc. Clears 18 of 20 pip-audit
findings (chromadb/nltk have no fixed release yet).
- npm update: next 16.2.10 (fixes 1 high + 3 moderate advisories),
ai 6.0.219, @ai-sdk/react 3.0.221, react 19.2.7, tailwind 4.3.2.
Two moderate advisories remain (postcss bundled in next; fix only
in 16.3 canaries). Stayed on AI SDK 6: the hand-rolled UI-message
stream encoder in app/api.py must be validated against v7 first.
- Dockerfile: node:20-alpine (EOL April 2026) -> node:22-alpine.

Verified: 220 pytest passed, frontend build + lint clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Dockerfile

@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1.6
 
 # Stage 1: build the Next.js frontend as a static export
-FROM node:20-alpine AS frontend
+FROM node:22-alpine AS frontend
 WORKDIR /frontend
 
 COPY frontend/package.json frontend/package-lock.json ./

frontend/next-env.d.ts

@@ -1,6 +1,6 @@
 /// <reference types="next" />
 /// <reference types="next/image-types/global" />
-import "./.next/dev/types/routes.d.ts";
+import "./.next/types/routes.d.ts";
 
 // NOTE: This file should not be edited
 // see https://nextjs.org/docs/app/api-reference/config/typescript for more information.