chore(security): patch vulnerable web dependencies

[Yeom-JinHo]

Description

This PR patches vulnerable dependencies in apps/www and refreshes the lockfile to resolve the related transitive security issues.

It updates the direct packages that were driving the audit findings, keeps the remediation scoped, and verifies that the app still typechecks and builds successfully without relying on temporary pnpm overrides.

Changes

• Bump next from ^15.5.4 to ^15.5.14
• Bump posthog-js from ^1.268.9 to ^1.363.1
• Bump ts-morph from ^23.0.0 to ^27.0.2
• Refresh pnpm-lock.yaml so patched transitive versions are resolved
• Verify pnpm audit --prod --dev, pnpm --filter=www typecheck, and pnpm --filter=www build

Motivation

The project had known security issues in both direct and transitive dependencies, including packages pulled in through Next.js, PostHog, and ts-morph.

This change fixes the audit findings with the smallest practical dependency updates and avoids a larger framework migration such as moving the Fumadocs stack to the latest major versions.

Breaking Changes

None.

[vercel]

@Yeom-JinHo is attempting to deploy a commit to the product-studio Team on Vercel.

A member of the Team first needs to authorize it.