## What changed
- Upgraded Next.js from 16.1.6 to 16.2.9 across the Next-consuming
packages and lockfile.
- Hardened builder response headers by disabling the powered-by header,
adding CSP directives, setting same-origin CORS for non-API pages, and
applying no-store headers to public entry assets/routes.
- Blocked OPTIONS, TRACE, and TRACK in the builder proxy with a 405
response and an explicit Allow header.
## Why
This addresses TAC scan findings around framework disclosure, cache
behavior, response hardening, and risky HTTP methods on builder routes.
## Validation
- `bunx nx typecheck builder` passed.
- `bunx nx typecheck` currently fails on an unrelated landing-page
telemetry header typing issue at
`apps/landing-page/src/features/telemetry/server/trackPageView.ts:85`
(`"Set-Cookie"` is not in `TypedHeaders<ResponseHeaderMap>`).
d039794797