chore: bump next to patched versions (CVE-2026-44578)

studio-v2: 16.1.4 → 16.2.5
website: 15.5.9 → 15.5.16
admin-lehrer: 15.1.0 → 15.5.16

Patches unauthenticated SSRF in WebSocket upgrade handler.
GHSA-c4j6-fc7j-m34r.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

admin-lehrer/package.json

@@ -22,7 +22,7 @@
     "jspdf": "^4.1.0",
     "jszip": "^3.10.1",
     "lucide-react": "^0.468.0",
-    "next": "^15.1.0",
+    "next": "^15.5.16",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "reactflow": "^11.11.4",