deps: bump next in /demo past 16.2.3 #64

What

demo pins next at ^16.2.3 (eslint-config-next is also ^16.2.3). Current Next.js 16.x security releases start at 16.3.3. Open Dependabot PR #47 only goes 16.2.3 → 16.2.6 in /demo and is not enough.

Where

• demo/package.json ("next": "^16.2.3", "eslint-config-next": "^16.2.3")
• demo/package-lock.json

Why it matters

The demo is the public Next.js sample for this library. Shipping it on an older 16.2.x pin means anyone who runs it locally (or deploys it) misses current 16.x patches. Prefer landing on a current patched 16.x.

Suggested fix

1. Bump next in demo/package.json to a current patched 16.x (at least 16.3.3, or the latest 16.x patch available when you open the PR).
2. Bump eslint-config-next to the same version.
3. Refresh the lockfile in demo (npm install / npm update next eslint-config-next as fits the repo).
4. Confirm npm run build (and a quick dev smoke) still work for the demo.
5. Keep the change scoped to demo unless the root package also needs a matching pin.

Notes

• Open Dependabot PR chore(deps): bump next from 16.2.3 to 16.2.6 in /demo in the npm_and_yarn group across 1 directory #47 (16.2.3 → 16.2.6 in /demo) does not reach 16.3.x. Close or supersede it once this bump lands.
• .github/dependabot.yml only watches npm at /, so version updates for /demo will not open on their own.
• Tracker dependabot: review open dependency PRs #59 still covers the other open Dependabot PRs (#48, #46, #45, #44, #39).

Acceptance

• demo uses a patched Next 16.x (≥ 16.3.3 or newer patch)
• eslint-config-next matches that Next version
• Lockfile updated
• Demo still builds