chore(deps): update Next.js to 15.5.21

[saagpatel]

What

• Update the web app's direct Next.js requirement from ^15.5.0 to ^15.5.21.
• Regenerate only the Next.js lockfile family so the resolved version is 15.5.21, including matching @next/env and platform @next/swc-* packages.
• Replace PR chore(deps): bump next from 15.5.19 to 15.5.21 in /web in the npm_and_yarn group across 1 directory #202 without closing it. This branch starts from current main and contains one dependency-only commit.

Why

The live Dependabot baseline has eight open Next.js alerts (#8-#15) whose first patched version is 15.5.21. PR #202 updated Next.js but its refreshed lockfile also moved unrelated @emnapi/runtime, caniuse-lite, nanoid, and semver entries. This replacement preserves the approved two-file boundary and leaves those unrelated packages unchanged.

Alert closure is expected only after merge and a separate live Dependabot readback; this PR does not claim that alerts are already closed.

Review Of What Was Built

• No application source changes and no Next.js 16 migration.
• Production build completed with Next.js 15.5.21.
• The production server returned HTTP 200 for / and /u/octocat, with expected route content.

Cleanup Review

No cleanup or refactor was performed. The patch intentionally excludes the unrelated lockfile upgrades present in PR #202.

Verification Summary

All package-manager, cache, HOME, XDG, temporary, Corepack, pnpm, and uv state was redirected to disposable isolated directories.

• pnpm install --frozen-lockfile --store-dir <isolated-store> — passed.
• pnpm typecheck — passed.
• pnpm build — passed with Next.js 15.5.21.
• Production route checks for / and /u/octocat — HTTP 200 with expected markers.
• python -m pytest -q -p no:cacheprovider tests/test_api_only.py — 14 passed.
• CI-equivalent Python 3.11 test suite — 2,969 passed, 2 skipped.
• CI-equivalent Python 3.12 test suite — 2,969 passed, 2 skipped.
• ruff check src/ tests/ on Python 3.11 and 3.12 — passed.
• Repository mypy target list on Python 3.11 and 3.12 — passed, 15 files checked.
• git diff --check and full lockfile audit — passed; exactly web/package.json and web/pnpm-lock.yaml changed.

Shipped Summary

The branch resolves Next.js 15.5.21 with only the required Next.js package-family lockfile changes. It is not merged and has not altered branch protection, reviews, or alerts.

Next Phase

Run fresh required checks and obtain one eligible independent approval on this exact head. Reviewer focus: confirm the two-file boundary, the absence of unrelated lockfile churn from PR #202, and the Next.js 15.5.21 resolution.

Remaining Roadmap

After separately authorized protected merge, re-read Dependabot state to confirm exact alert closure. Current expectation: alerts #8-#15 close, leaving sharp #7 and postcss #16-#17 open.