security: patch CVE-2025-55182 (React RCE vulnerability) (#91)

### Summary

This PR patches **CVE-2025-55182**, a critical Remote Code Execution
vulnerability affecting React Server Components.

### What's Changed

- Added `overrides` / `resolutions` to `package.json` to pin Next.js to
patched versions
  - `16.x` → `16.0.7`
  - `15.x` → `15.5.7`
  - `14.3.0-canary.*` → `14.3.0-canary.88` (if applicable)
- Regenerated lockfile with patched dependencies

### Why This Matters

> "Default configurations are vulnerable — a standard Next.js app
created with `create-next-app` and built for production can be exploited
with no code changes by the developer."
> — Wiz Security Research

Applications using React Server Components (including all Next.js App
Router apps) are vulnerable to unauthenticated RCE via malicious
payloads sent to Server Function endpoints.

### CVE Details

| | |
|---|---|
| **CVE** | CVE-2025-55182 |
| **CVSS Score** | 10.0 (Critical) |
| **Attack Vector** | Network (unauthenticated) |
| **Impact** | Remote Code Execution |


### References

- [React Security
Advisory](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components)
- [Wiz Technical
Writeup](https://www.wiz.io/blog/critical-vulnerability-in-react-cve-2025-55182)
- [Next.js Security Advisory
(GHSA-9qr9-h5gf-34mp)](GHSA-9qr9-h5gf-34mp)
- [Internal Reference
PR](https://github.com/scaleapi/scaleapi/pull/129864)

### Test Plan

- [ ] CI passes
- [ ] Application builds successfully
- [ ] `yarn.lock` / `package-lock.json` / `pnpm-lock.yaml` shows patched
Next.js version

## Patched Subdirectories

- ✅ `agentex-ui`: 15.5.2 → 15.5.7 (npm)

Author: freeqaz-scale

agentex-ui/package-lock.json

@@ -39,7 +39,7 @@
     "date-fns": "^4.1.0",
     "framer-motion": "^12.23.24",
     "lucide-react": "^0.525.0",
-    "next": "15.5.2",
+    "next": "15.5.7",
     "next-themes": "^0.4.6",
     "react": "^19.1.1",
     "react-dom": "^19.1.1",