fix(deps): upgrade Next.js to 16.4.1 on lts/1.13.x

[lyzno1]

Summary

Backport #44127 to lts/1.13.x, adapting the dependency update to the Web-local manifest and lockfile. Upgrade next, @next/mdx, and @next/eslint-plugin-next from 16.3.8 to 16.4.1. Align @next/env and all SWC packages, including an override for Storybook's pinned @next/env 16.0.0. Next.js resolves the existing sharp 0.35.5.

This includes the October 14 fixes for CVE-2026-96889, GHSA-673q-mjm6-r5xr, and GHSA-p3m5-59mp-jv5r.

Validation

• pnpm install --frozen-lockfile (pnpm 10.32.1)
• Production build with Node 22.23.3 and Next.js 16.4.1
• pnpm lint:tss: 5,420 files passed
• pnpm eslint package.json and git diff --check
• Lockfile audit: all Next.js family packages resolve to 16.4.1; no unrelated package version upgrades.
• pnpm type-check:tsgo is blocked by five existing undefined renderPopup references in web/app/components/header/account-setting/model-provider-page/model-selector/__tests__/popup.spec.tsx (lines 214, 244, 270, 307, and 335). The unchanged base file contains the same references.
• Legacy staged checks passed: pnpm exec lint-staged --diff HEAD^..HEAD. (vp staged is unavailable on this LTS because its Vite config has no staged configuration.)

Merge dependency

Merge #44127 first. This commit carries cherry-pick -x provenance from e81490acc23422f0108b7511ecc30ec3a009a898. The LTS provenance check cannot pass until the source is reachable from main; if the main PR is squash-merged to a different SHA, update the provenance to that merged commit before merging this backport.

From Codex