fix(website): bump next-auth and sharp to close Dependabot alerts

[absorbb]

Closes the 4 open Dependabot alerts (#144–#147), all in packages/website.

Changes

• next-auth ^5.0.0-beta.30 → ^5.0.0-beta.32, which pins @auth/core@0.41.3. Fixes:
  • #146 (critical) — email normalizer validated before Unicode normalization, allowing a homoglyph @ bypass
  • #147 (high) — getToken() throws an uncaught exception on malformed Bearer headers
  • #145 (medium) — OAuth state / nonce / PKCE check cookies not bound to the provider that created them
• Drop the direct @auth/core@^0.34.3 dependency. Nothing in the repo imports it; next-auth ships its own pinned copy, so the stale 0.34.3 was a second vulnerable copy in the lockfile for no benefit.
• sharp ^0.34.5 → ^0.35.4 (#144 — libvips CVE-2026-33327 / 33328 / 35590 / 35591). next@15.5.11 declares sharp ^0.34.3 as an optional dep, which kept a nested sharp@0.34.5 in bun.lock, so a root overrides forces it onto 0.35 as well. next@16 itself already uses sharp ^0.35.3, so this is within Next's supported range.

Behaviour note

next-auth@beta.32 also changes one thing beyond the security fixes: a non-OK session response now yields no session instead of an error object. Checked every auth() / useSession consumer (lib/auth.ts, nextlytics.ts, app/demo/layout.tsx) — all only test session?.user, none branch on session.error, so this is a no-op here.

Verification

• bun install --frozen-lockfile — no changes
• bun run verify (typecheck, lint, format:check, test) — green
• bun run build — green (exercises Next with the overridden sharp)
• bun packages/website/scripts/generate-icons.ts — the only direct sharp consumer, runs cleanly on 0.35.4
• bun.lock now contains exactly one sharp (0.35.4) and one @auth/core (0.41.3) entry

🤖 Generated with Claude Code