chore: bump next to patched versions (CVE-2026-44578)

studio-v2: 16.1.4 → 16.2.5
website: 15.5.9 → 15.5.16
admin-lehrer: 15.1.0 → 15.5.16

Patches unauthenticated SSRF in WebSocket upgrade handler.
GHSA-c4j6-fc7j-m34r.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

studio-v2/package.json

@@ -18,7 +18,7 @@
     "leaflet": "^1.9.4",
     "lucide-react": "^0.563.0",
     "maplibre-gl": "^4.7.1",
-    "next": "^16.1.4",
+    "next": "^16.2.5",
     "pdf-lib": "^1.17.1",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",