fix(ci): make main deployable again — coverage, CVEs, and the image job

Found while preparing the tenant-registry enforcement flip: the deployed
portal image is from June 10, so the service-token code merged in #21
never shipped — flipping tenant-registry would have broken every portal
page. Three independent defects:

1. The image job's job-level hashFiles('Dockerfile') condition evaluates
   BEFORE checkout against an empty workspace — always false, job
   silently skipped on every main push. Same bug just fixed in
   tenant-registry (#16).

2. The test job was red on #21's merge: this repo pins 100%
   function/branch coverage and my local run skipped --coverage. Closed
   for real, not lowered: two dead json() arrows removed from mocks the
   code never reads (it throws on !ok before touching the body), and a
   new test exercising the expires_in ?? 300 default-lifetime branch.
   80 tests, 100/100/100/100.

3. The shared job's trivy gate was red on 14 real findings (3 CRITICAL):
   @auth/core 0.37.2 -> 0.41.3 (CVE-2026-73420, Unicode-normalization
   email homoglyph bypass — in the auth library this rollout depends on),
   next 16.2.6 -> 16.2.11, nanoid + postcss via pnpm overrides.
   next-auth 5.0.0-beta.25 -> beta.30; typecheck, lint and build clean
   on the new versions.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

package.json

@@ -23,8 +23,8 @@
     "clsx": "^2.1.1",
     "geist": "^1.7.2",
     "lucide-react": "^1.17.0",
-    "next": "16.2.6",
-    "next-auth": "5.0.0-beta.25",
+    "next": "16.2.11",
+    "next-auth": "5.0.0-beta.30",
     "react": "19.0.0",
     "react-dom": "19.0.0",
     "tailwind-merge": "^3.6.0"
@@ -48,5 +48,12 @@
     "workerDirectory": [
       "public"
     ]
+  },
+  "pnpm": {
+    "overrides": {
+      "nanoid@<3.3.18": ">=3.3.18",
+      "postcss@<8.4.31": ">=8.4.31",
+      "@auth/core@<0.41.3": ">=0.41.3"
+    }
   }
-}
+}