chore: bump next to patched versions (CVE-2026-44578)

studio-v2: 16.1.4 → 16.2.5
website: 15.5.9 → 15.5.16
admin-lehrer: 15.1.0 → 15.5.16

Patches unauthenticated SSRF in WebSocket upgrade handler.
GHSA-c4j6-fc7j-m34r.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

website/package.json

@@ -14,7 +14,7 @@
     "@stripe/stripe-js": "^4.9.0",
     "bpmn-js": "^18.11.0",
     "lucide-react": "^0.563.0",
-    "next": "^15.5.9",
+    "next": "^15.5.16",
     "react": "18.3.1",
     "react-dom": "18.3.1",
     "react-simple-maps": "^3.0.0",