fix(frontend): 升级 Next→15.5.20 + React 19.2.7 修 RCE/补丁 + 版本下界守卫（CR-C1）

- next/eslint-config-next 15.1.3→15.5.20（backport 安全维护线），react/react-dom 19.0.0→19.2.7
- @types/react(-dom) →^19.2.0；pnpm audit --prod 无 next/react/react-dom 高危/严重告警
- 新增 lib/security/dependencyFloors 守卫 + 回归测试锁定安全下界
- 连带修 useDraftStream.test noUncheckedIndexedAccess（重锁失效增量缓存后暴露，对齐 useReviewStream 既有 ! 约定）

apps/web/lib/security/dependencyFloors.test.ts

@@ -0,0 +1,70 @@
+import { readFileSync } from "node:fs";
+
+import { describe, expect, it } from "vitest";
+
+import { isAtLeast, SECURITY_FLOORS } from "./dependencyFloors";
+
+// 读取本包 package.json 声明版本（相对本测试文件 ../../ → apps/web/package.json）。
+function declaredVersions(): Record<string, string> {
+  const raw = readFileSync(
+    new URL("../../package.json", import.meta.url),
+    "utf-8",
+  );
+  const pkg = JSON.parse(raw) as {
+    dependencies?: Record<string, string>;
+    devDependencies?: Record<string, string>;
+  };
+  return { ...pkg.devDependencies, ...pkg.dependencies };
+}
+
+describe("SECURITY_FLOORS 锁定安全下界（CR-C1）", () => {
+  const declared = declaredVersions();
+
+  it.each(Object.keys(SECURITY_FLOORS))(
+    "%s 声明版本不得低于安全下界",
+    (name) => {
+      const version = declared[name];
+      if (version === undefined) {
+        throw new Error(`${name} 未在 package.json 声明`);
+      }
+      const floor = SECURITY_FLOORS[name as keyof typeof SECURITY_FLOORS];
+      expect(
+        isAtLeast(version, floor),
+        `${name}@${version} 低于安全下界 ${floor}`,
+      ).toBe(true);
+    },
+  );
+});
+
+describe("isAtLeast 语义版本比较", () => {
+  it("相等即满足", () => {
+    expect(isAtLeast("15.5.20", "15.5.20")).toBe(true);
+  });
+
+  it("patch 更高满足、更低不满足", () => {
+    expect(isAtLeast("19.2.7", "19.2.0")).toBe(true);
+    expect(isAtLeast("19.2.0", "19.2.7")).toBe(false);
+  });
+
+  it("minor 边界", () => {
+    expect(isAtLeast("15.5.0", "15.1.3")).toBe(true);
+    expect(isAtLeast("15.1.3", "15.5.20")).toBe(false);
+  });
+
+  it("major 边界", () => {
+    expect(isAtLeast("19.0.0", "18.9.9")).toBe(true);
+    expect(isAtLeast("18.9.9", "19.0.0")).toBe(false);
+  });
+
+  it("去除前导 ^ / ~ 范围符", () => {
+    expect(isAtLeast("^19.2.7", "19.2.7")).toBe(true);
+    expect(isAtLeast("~19.2.7", "19.2.7")).toBe(true);
+    expect(isAtLeast("19.2.0", "^19.2.7")).toBe(false);
+  });
+
+  it("缺省段按 0 计", () => {
+    expect(isAtLeast("15", "15.0.0")).toBe(true);
+    expect(isAtLeast("15.5", "15.5.0")).toBe(true);
+    expect(isAtLeast("15", "15.5.0")).toBe(false);
+  });
+});

apps/web/lib/security/dependencyFloors.ts

@@ -0,0 +1,30 @@
+// 依赖安全下界守卫：锁定 next/react/react-dom 不得低于修补 RCE / 安全补丁的最低版本。
+// dependencyFloors.test.ts 读取 package.json 声明版本比对，回归防止误降级回易受攻击版本（CR-C1）。
+
+export const SECURITY_FLOORS = {
+  next: "15.5.20",
+  react: "19.2.7",
+  "react-dom": "19.2.7",
+} as const;
+
+// 语义版本比较：version >= floor（仅比对 major.minor.patch，忽略预发布 / 构建元数据）。
+// 去除前导 ^ / ~ 范围符；缺省段按 0 计；非数字段按 0 计。
+export function isAtLeast(version: string, floor: string): boolean {
+  const a = parseSemver(version);
+  const b = parseSemver(floor);
+  for (let i = 0; i < 3; i += 1) {
+    const av = a[i] ?? 0;
+    const bv = b[i] ?? 0;
+    if (av > bv) return true;
+    if (av < bv) return false;
+  }
+  return true;
+}
+
+function parseSemver(raw: string): number[] {
+  const cleaned = raw.trim().replace(/^[\^~]/, "");
+  return cleaned.split(".").map((part) => {
+    const n = Number.parseInt(part, 10);
+    return Number.isNaN(n) ? 0 : n;
+  });
+}

apps/web/lib/stream/useDraftStream.test.ts

@@ -85,7 +85,7 @@ describe("useDraftStream", () => {
       await result.current.start("p1", 2, "  写得热血一点  ");
     });
 
-    const [, init] = fetchMock.mock.calls[0];
+    const [, init] = fetchMock.mock.calls[0]!;
     expect(init.method).toBe("POST");
     expect(init.headers["Content-Type"]).toBe("application/json");
     expect(JSON.parse(init.body as string)).toEqual({ directive: "写得热血一点" });
@@ -99,7 +99,7 @@ describe("useDraftStream", () => {
       await result.current.start("p1", 2, "   ");
     });
 
-    const [, init] = fetchMock.mock.calls[0];
+    const [, init] = fetchMock.mock.calls[0]!;
     expect(init.body).toBeUndefined();
     expect(init.headers["Content-Type"]).toBeUndefined();
   });