bump: next 15.4.3 -> 16.2.6, ESLint flat config (v9 fallback), typescript devDep

Closes P0 ship-blocker #8 from .convoys/ship-readiness.md. Vercel has
been refusing every deployment since 2025-08-01 with "Vulnerable version
of Next.js detected, please update immediately" — this bump clears
that platform gate and unblocks every downstream preview-smoke and
visual-diff gate that depends on a live preview URL.

Changes (per Brief 1 acceptance criteria, all four gate-1 decisions
applied — see .convoys/bump-next-js.md § Decisions for the audit trail):

- next: ^15.4.2 -> ^16.2.6 (resolves next@16.2.6)
- eslint: ^8 -> ^9.39.4 (Decision D fallback; v10 surfaced Risk R15
  empirically — @typescript-eslint/scope-manager@8.59.4 bundled by
  eslint-config-next@16 doesn't implement v10's new addGlobals API)
- eslint-config-next: 15.4.2 -> ^16.2.6
- typescript: newly added at ^5.9.3 as a devDep (Decision C; required
  by typescript-eslint chain regardless of ESLint major)
- scripts.lint: "next lint" -> "eslint ." (next lint removed in 16)
- next.config.js: images.domains -> images.remotePatterns (deprecated
  and removed in Next 16; preserves the three CDN hosts Scryfall,
  Pokemon TCG, Lorcana API for eventual next/image adoption)
- .eslintrc.json deleted (eslint-config-next@16 is flat-config-only)
- eslint.config.mjs added (verbatim shape from Next docs; verified
  forward-compatible with v10 so bump-eslint-10 will not need to
  touch this file)

Out of scope (deferred to dedicated convoys):
- React 18 -> 19 (bump-react)
- App Router migration (multi-month effort)
- Test runner adoption (adopt-vitest, adopt-playwright-smoke)
- Lint baseline cleanup (fix-lint-baseline) — new v9 baseline is
  128 problems (81 errors, 47 warnings), up from prior ~100 due to
  eslint-plugin-react-hooks@7.1.1 + @next/eslint-plugin-next@16.2.6
  rule additions
- ESLint v10 adoption (bump-eslint-10) — upstream-blocked on
  typescript-eslint shipping a v10-tested release that
  eslint-config-next then bundles
- TypeScript 6 adoption (bump-typescript-6) — same upstream block

Local verification:
- npm install: clean, no ERESOLVE warnings
- npm run build: exit 0, Next 16.2.6 (Turbopack), ~1.4s compile,
  23 static pages + 47 API routes, no images.domains deprecation
- npm run lint: exit 1, 128 problems, runs to completion (tolerated
  by CI's `|| true` wrapper; new baseline for fix-lint-baseline)

Co-authored-by: Cursor <cursoragent@cursor.com>

.eslintrc.json

@@ -1,3 +0,0 @@
-{
-  "extends": "next/core-web-vitals"
-}

eslint.config.mjs

@@ -0,0 +1,16 @@
+import { defineConfig, globalIgnores } from 'eslint/config';
+import nextVitals from 'eslint-config-next/core-web-vitals';
+
+const eslintConfig = defineConfig([
+  ...nextVitals,
+  globalIgnores([
+    '.next/**',
+    'node_modules/**',
+    'out/**',
+    'build/**',
+    'next-env.d.ts',
+    'scripts/migrations/**',
+  ]),
+]);
+
+export default eslintConfig;

next.config.js

@@ -1,7 +1,11 @@
 /** @type {import('next').NextConfig} */
 const nextConfig = {
   images: {
-    domains: ['api.scryfall.com', 'images.pokemontcg.io', 'lorcana-api.com'],
+    remotePatterns: [
+      { protocol: 'https', hostname: 'api.scryfall.com' },
+      { protocol: 'https', hostname: 'images.pokemontcg.io' },
+      { protocol: 'https', hostname: 'lorcana-api.com' },
+    ],
   },
 };
 

package.json

@@ -7,7 +7,7 @@
     "dev": "next dev",
     "build": "next build",
     "start": "next start",
-    "lint": "next lint",
+    "lint": "eslint .",
     "setup-db": "node scripts/setup-neon-db.js",
     "import-popular": "node scripts/import-popular-sets.js",
     "import-all": "node scripts/bulk-import-all.js"
@@ -19,7 +19,7 @@
     "bcryptjs": "^3.0.2",
     "dotenv": "^17.2.1",
     "jsonwebtoken": "^9.0.2",
-    "next": "^15.4.2",
+    "next": "^16.2.6",
     "node-fetch": "^3.3.2",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
@@ -27,9 +27,10 @@
   },
   "devDependencies": {
     "autoprefixer": "^10.4.21",
-    "eslint": "^8",
-    "eslint-config-next": "15.4.2",
+    "eslint": "^9.39.4",
+    "eslint-config-next": "^16.2.6",
     "postcss": "^8.5.6",
-    "tailwindcss": "^3.4.17"
+    "tailwindcss": "^3.4.17",
+    "typescript": "^5.9.3"
   }
 }