fix(deps): upgrade Next.js to 16.4.1 for October security fixes

[lyzno1]

Summary

Upgrade Next.js from 16.4.0 to 16.4.1 for the October 14 security release. Regenerate the workspace lockfile so Web, nuqs-jotai, Storybook, and vinext resolve the patched Next.js version, with matching @next/env and all platform SWC packages. Verify that Next.js resolves sharp 0.35.5.

Official advisories: CVE-2026-96889, GHSA-673q-mjm6-r5xr, and GHSA-p3m5-59mp-jv5r.

Validation

• pnpm install --frozen-lockfile
• vp run -w check (0 errors; existing warnings)
• vp staged
• NEXT_TELEMETRY_DISABLED=1 pnpm --filter dify-web build
• Lockfile audit: only Next.js family package versions changed; all resolve to 16.4.1.
• git diff --check

LTS backports: #44128 targets lts/1.13.x; #44129 targets lts/1.17.x. Both depend on this change landing first for cherry-pick provenance.

From Codex

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.98%. Comparing base (f77facf) to head (e81490a).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #44127   +/-   ##
=======================================
  Coverage   88.98%   88.98%           
=======================================
  Files        5339     5339           
  Lines      330714   330714           
  Branches    66018    66018           
=======================================
+ Hits       294286   294287    +1     
+ Misses      31216    31215    -1     
  Partials     5212     5212           

Flag	Coverage Δ
cli	90.56% <ø> (ø)
dify-ui	92.25% <ø> (ø)
web	89.36% <ø> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.