fix(deps): clear all 206 pnpm audit vulnerabilities (2 crit, 78 high,105 mod, 21 low)

[i-subham23]

Resolves every advisory reported by pnpm audit (206 -> 0). Approach: fix at the proper source (workspace direct-dep bumps) wherever possible; use pnpm.overrides only for transitives whose parent SDK is already at its latest published version (i.e. truly upstream-stuck).

Direct-dep bumps (the bulk of fixes):

• docs/: next 16.1.6->16.2.6, fumadocs-{core,mdx,ui} 16.6.5->16.9.1, posthog-js ^1.358->^1.376, openai ^6.22->^6.39, postcss ^8.5.6->^8.5.15; toc subpath import fix required by fumadocs-ui bump.
• 11 Next.js example apps: next 16.1.6 -> 16.2.6 (+ matching eslint-config-next), openai -> ^6.39.0.
• examples/openui-react-native/backend: next ^15.2.3 -> ^15.5.18.
• examples/openui-react-native/chat-app: expo ~54.0.6 -> ~54.0.34.
• examples/svelte-chat: vite -> ^6.4.2, @sveltejs/kit -> ^2.61.1, @sveltejs/vite-plugin-svelte -> ^5.1.1, svelte -> ^5.55.9, @ai-sdk/svelte 3.x -> ^4.0.191 (major), @ai-sdk/openai -> ^3.0.65, ai -> ^6.0.191.
• examples/vue-chat: nuxt ^3.17 -> ^3.21.6, @ai-sdk/vue -> ^3.0.191, @ai-sdk/openai -> ^3.0.65, ai -> ^6.0.191.
• examples/mastra-chat: @ag-ui/core ^0.0.45->^0.0.53, @ag-ui/mastra ^1.0.1->^1.0.2.
• examples/{multi-agent-chat,vercel-ai-chat}: @ai-sdk/react ^3.0.118 ->^3.0.193, @ai-sdk/openai -> ^3.0.65, ai -> ^6.0.191 (fixes UIMessage type incompatibility from coexisting ai majors).
• examples/openui-artifact-demo: react-syntax-highlighter ^15.6 ->^16.1.1.
• examples/hands-on-table-chat: switched 4 @openuidev/* deps from published ^0.x versions to workspace:* (every other example uses workspace links; aligns this one); handsontable + react-wrapper 17.0.1 -> 17.1.0.
• examples/supabase-chat: @supabase/ssr ^0.5->^0.10.3, @supabase/supabase-js ^2.49->^2.106.2 (clears ws CVE).
• packages/react-ui: storybook + 11 @storybook/* addons ^8.5.3 ->^8.6.18; vite ^5->^6.4.2; webpack ^5.104.1 added as direct devDep (forces pnpm to hoist non-vulnerable webpack for @storybook/addon-styling-webpack peer); react-syntax-highlighter 15->^16.1.1 (fixes prismjs); lodash-es ^4.17.21->^4.18.1; @typescript-eslint/eslint-plugin ^8.56->^8.59.4; @types/node-fetch 2.6.11->2.6.13; form-data ^4.0->^4.0.5; postcss spec ^8.5.1->^8.5.15; tailwindcss ^3 -> ^3.4.19.
• packages/svelte-lang: vite ^6->^6.4.2, vitest ^3->^3.2.4, svelte ^5->^5.55.9, @sveltejs/vite-plugin-svelte ^5->^5.1.1, jsdom ^26->^29.1.1.
• packages/vue-lang: @vitejs/plugin-vue ^5->^6.0.7 (major), @vue/test-utils ^2.4->^2.4.10, vite ^6->^6.4.2, vitest ^3->^3.2.4, jsdom ^26->^29.1.1.
• packages/{lang-core,react-lang}: vitest ^4.0.18->^4.1.7.
• packages/browser-bundle: esbuild ^0.24->^0.25.12.
• Root: @typescript-eslint/eslint-plugin ^8.56->^8.59.4; tsdown ^0.21.7->^0.22.0 (newer rolldown internals dropped a huge vulnerable transitive chain).

pnpm.overrides block (6 entries, each truly upstream-stuck):

• langsmith@<0.6.0 deep inside @copilotkit/runtime via @ag-ui/mastra
  (latest). RSS deserialization fix.
• ip-address@<10.1.1 via @modelcontextprotocol/sdk@1.29.0 (latest),
  @mastra/core@1.15.0 (latest), @ag-ui/mastra
  (latest). XSS in Address6 HTML emitters.
• postcss@<8.5.10 bundled as postcss@8.4.31 inside next@16.2.6
  (latest stable; only 16.3 canaries exist).
  XSS via unescaped </style>.
• qs@<6.15.2 via @mastra/core (latest), @ag-ui/mastra (latest).
  DoS via comma-format TypeError.
• uuid@<11.1.1 via @ag-ui/mastra (latest), expo@~54.0.34
  (latest in major), @storybook/addon-essentials
  8.6.18 (latest 8.x; Storybook 8 is EOL).
  Buffer bounds check.
• cookie@<0.7.0 via @sveltejs/kit@2.61.1 (latest), which pins
  cookie@^0.6.0. OOB chars in cookie name/path.

Each override is removable when the named upstream parent ships a patch.

Final audit: 0 critical / 0 high / 0 moderate / 0 low. pnpm install --frozen-lockfile passes (CI-mode install). All Next.js example builds verified. svelte-chat build verified after @ai-sdk/svelte major bump. vue-chat builds clean on CI Linux; fails locally on darwin-arm64 due to a pre-existing pnpm 9 + oxc-walker native-bindings bug (unrelated to this change — same failure on main).

What

Describe the change and why it is needed.

Changes

Test Plan

Describe how you validated this change.

• Not applicable (explain why)
• Verified locally

Checklist

• I linked a related issue, if applicable
• I updated docs/README when needed
• I considered backwards compatibility