fix(deps): next 16.3.3 -> 16.3.6 (GHSA-vcvr-r3jv-pc5j, CRITICAL)

Remote code execution in next/og ImageResponse, fixed in 16.3.6.
Same minor line; the exact pin in package.json moves too and the
lockfile follows (next, @next/env, @next/swc-* platform binaries,
sharp optional range ^0.35.4).

Not fixed here (need a direct-dependency major bump or have no fix):
- nodemailer 9.1.1: GHSA-prgh-xp8r-p3m5 / GHSA-v53p-9fqp-m79j fixed only in 10.0.5/10.0.6 (major)
- xlsx 0.20.3: GHSA-4r6h-8v6p-xvw6 / GHSA-5pgg-2g8v-p4x9 have no published fix

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

package.json

@@ -63,7 +63,7 @@
     "jszip": "^3.10.1",
     "lucide-react": "^1.24.0",
     "mailparser": "^3.9.14",
-    "next": "16.3.3",
+    "next": "16.3.6",
     "next-intl": "^4.13.2",
     "next-themes": "^0.4.6",
     "nodemailer": "9.1.1",