fix(frontend): 升级 Next→15.5.20 + React 19.2.7 修 RCE/补丁 + 版本下界守卫（CR-C1）

- next/eslint-config-next 15.1.3→15.5.20（backport 安全维护线），react/react-dom 19.0.0→19.2.7
- @types/react(-dom) →^19.2.0；pnpm audit --prod 无 next/react/react-dom 高危/严重告警
- 新增 lib/security/dependencyFloors 守卫 + 回归测试锁定安全下界
- 连带修 useDraftStream.test noUncheckedIndexedAccess（重锁失效增量缓存后暴露，对齐 useReviewStream 既有 ! 约定）

apps/web/package.json

@@ -16,21 +16,21 @@
     "@dagrejs/dagre": "^3.0.0",
     "@xyflow/react": "^12.11.2",
     "lucide-react": "^1.21.0",
-    "next": "15.1.3",
+    "next": "15.5.20",
     "openapi-fetch": "^0.13.0",
-    "react": "19.0.0",
-    "react-dom": "19.0.0"
+    "react": "19.2.7",
+    "react-dom": "19.2.7"
   },
   "devDependencies": {
     "@testing-library/dom": "^10.4.1",
     "@testing-library/react": "^16.3.2",
     "@types/node": "^22.10.0",
-    "@types/react": "19.0.0",
-    "@types/react-dom": "19.0.0",
+    "@types/react": "^19.2.0",
+    "@types/react-dom": "^19.2.0",
     "@vitest/coverage-v8": "^2.1.9",
     "autoprefixer": "^10.4.20",
     "eslint": "^9.17.0",
-    "eslint-config-next": "15.1.3",
+    "eslint-config-next": "15.5.20",
     "jsdom": "^29.1.1",
     "openapi-typescript": "^7.5.0",
     "playwright": "^1.61.1",