fix: bump next to 15.3.9 (CVE-2025-66478)

[mvanhorn]

Bumps next from 15.3.1 to 15.3.9 to address CVE-2025-66478 (React Server Components RCE, CVSS 10.0) reported in #500.

The reporter cited 15.3.6 as the minimum patched version. This PR uses 15.3.9 instead because yarn audit flagged 15.3.6 as also vulnerable to a separate issue documented at https://nextjs.org/blog/security-update-2025-12-11. 15.3.9 is the latest 15.3.x and addresses both.

Verified locally:

• yarn install regenerated yarn.lock (canonical per packageManager: yarn@1.22.22)
• node_modules/next/package.json reports installed version 15.3.9
• yarn audit no longer flags next for CVE-2025-66478 or the 2025-12-11 issue

package-lock.json is also present in the repo (dual lockfile) but left untouched in this PR since packageManager declares yarn as canonical. The dual-lockfile state is worth a follow-up cleanup but out of scope here.

15.4.x has additional security patches per yarn audit. That's a minor-version bump - happy to do it as a follow-up if you'd like.

Fixes #500

[gemini-code-assist]

Code Review

This pull request updates the next framework from version 15.3.1 to 15.3.9 and introduces a comprehensive set of dependencies for math rendering, including katex, remark-math, and rehype-katex. Feedback indicates that eslint-config-next should also be updated to version 15.3.9 to ensure compatibility and consistent linting rules with the new framework version.

[gemini-code-assist]

While you've correctly updated the next dependency, the corresponding eslint-config-next in devDependencies is still at version 15.3.1. To ensure compatibility and that you're using the correct linting rules for this version of Next.js, please also update eslint-config-next to 15.3.9.