chore: update routine deps

[BastiOfBerlin]

deps: routine updates

Part of the series in #553. Two commits, three changed import lines, no
behaviour change intended.

This turned out to be much smaller than I advertised in #553

I had this down as "folds nine merged Dependabot PRs from my fork". That framing
was wrong, and the reason is worth stating because it also shrinks the
major-upgrades PR later in the series.

main's lockfile is already current for almost everything. npm ci installs
what the lockfile pins, carets float, and the lockfile has been regenerated
recently (#556, #558). So:

declared in package.json	actually installed
@radix-ui/react-select: ^2.3.0	2.3.7
@tanstack/react-query: ^5.59.15	5.101.4
@trpc/server: ^11.0.0-rc.586	11.18.0 — stable, not the rc
dayjs: ^1.11.10	1.11.21
next: ^16.0.7	16.3.1
prettier: ^3.0.3	3.9.6

Nothing there needs upgrading. My fork's versions of those lines were behind
what you already ship. So this PR is not the batch of routine bumps I described
— it's the handful the caret ranges were actually blocking, plus a cleanup.

1. The six that were genuinely stale

Each of these needed a major-range change to move at all:

• content-disposition 0.5.4 → 2.0.1. v2 exports create instead of a
  default, so the CSV and JSON export routes import
  { create as contentDisposition }. It ships its own types, so
  @types/content-disposition goes.
• negotiator 0.6.4 → 1.0.0
• @formatjs/intl-localematcher 0.5.10 → 0.8.13
• next-themes 0.2.1 → 0.4.6. ThemeProviderProps moved to the package
  root; the next-themes/dist/types deep import no longer resolves.
• dotenv 16.6.1 → 17.4.2
• @total-typescript/ts-reset 0.5.1 → 0.6.1

The first three belong together. next-intl 4.13 already depends on
@formatjs/intl-localematcher@^0.8 and negotiator@^1, so pinning the root at
0.5 and 0.6 forced npm to carry nested duplicate copies of both. Raising the
root deduplicates them.

Also dropped uuid and @types/uuid — nothing imports uuid. next-s3-upload
pulls its own copy, which is now hoisted rather than nested.

Net: 930 packages, down from 934.

2. Realigning the declared ranges — provably a no-op

43 dependencies declare a floor far below what is installed. tailwindcss: "^3"
resolving to 3.4.19; "@types/node": "^20" to 20.19.43. The manifest describes a
tree nobody runs.

That costs two things: a fresh npm install without the lockfile may legally
pick something years older than CI has ever exercised, and reading
package.json — the normal way to answer "what are we on" — currently gives the
wrong answer for a third of the tree.

Each range is raised to ^<installed>, so no major boundary is crossed and
nothing is upgraded; the installed version already satisfied the old range by
definition.

I verified this rather than asserting it. Regenerating the lockfile from
scratch with the old floors and with the new ones produces identical
resolutions for all 930 packages — I diffed every entry. The only lockfile
change in that commit is the root entry, which mirrors package.json.

It's a separate commit precisely so you can drop it if you'd rather not carry
the churn. Commit 1 stands alone without it.

Deliberately left behind

prisma/@prisma/client at 6, zod at 3, typescript at 5, jest at 29,
tailwindcss at 3, lucide-react at 0.501, openai at 4,
@hookform/resolvers at 3, @types/react at 18. Those have API surface and get
their own PR.

One of them is worth flagging now, though: react is on 19.2.8 while
@types/react is on 18.3.31. That mismatch is pre-existing on main, not
something this PR introduces, and it type-checks today — but it's the kind of
thing that produces confusing errors, so I'll fix it in the major-upgrades PR
unless you'd rather have it sooner.

On the audit warning

npm audit reports 2 moderate advisories against uuid (GHSA-w5hq-g745-h8pq),
reached through next-s3-upload. This PR does not fix that and does not make
it worse — it's transitive, next-s3-upload pins its own range, and there's no
patched version in that range. Dropping our direct uuid doesn't help because
it was never the vulnerable path. Same advisory count before and after.

Verification

Against f8ccc7a, Node 24 / npm 11: npm ci --ignore-scripts,
npx prisma generate, check-types, lint (16 warnings / 0 errors, all
pre-existing), check-formatting, npm test — 7 suites, 101 tests.

Also ran a full npm run build, since tsc won't catch runtime breakage from
the Radix or next-intl resolution changes. All 25 routes compile.

Not verified: the two export routes and the theme toggle in a browser. The
content-disposition and next-themes changes are the only ones that touch
running code, and both are worth a click — a CSV export with a non-ASCII group
name, and a dark/light toggle.