chore(deps): update to Next 16 and maplibre 6, bump the CI actions

[xAlcahest]

Summary

Folds the Dependabot PRs that passed verification (#1, #3, #4, #5, #7, #8, #9) into one update, each checked with typecheck, tests, build, a live smoke run against the real database and a Docker build. Next 16 needs three small changes: a turbopackIgnore on the dynamic stat in src/lib/db.ts, without which the whole project is traced into the standalone output; data-scroll-behavior on the html element; and the tsconfig rewrite Next performs itself. maplibre-gl 6 resolves its worker from import.meta.url, which the bundler cannot serve, so scripts/copy-maplibre-worker.mjs copies the worker and its shared module into public/maplibre and MapView points setWorkerUrl there. Next 16 also brings postcss, nanoid and sharp past the versions in the six open Dependabot security alerts. The tooling group (#6) is left out: TypeScript 7 has no programmatic API and Next needs one, and @types/node 26 does not match the Node 22 we run.

Changes

• package.json, pnpm-lock.yaml: next 16.3.2, react 19.2.8, maplibre-gl 6.5.0, gtfs-realtime-bindings 2.2.0, @types/yauzl 3.4.0; the lint script is gone with next lint.
• scripts/copy-maplibre-worker.mjs: copies the maplibre worker and shared module into public/maplibre before dev and build.
• src/components/map/MapView.tsx: setWorkerUrl to the copied worker.
• src/lib/db.ts: turbopackIgnore on the stat of the database path.
• src/app/layout.tsx: data-scroll-behavior on the html element.
• tsconfig.json: jsx react-jsx and the .next/dev/types include, as written by Next 16.
• .github/workflows/*.yml: checkout v7, setup-node v7, pnpm/action-setup v6, codeql-action v4.
• .github/dependabot.yml: ignore majors of typescript and @types/node.
• .gitignore: public/maplibre.