chore(security): bump vulnerable deps to clear Dependabot alerts (#24698)

## What

Bumps vulnerable dependencies to clear the breaching **GitHub
Dependabot** security alerts on `twentyhq/twenty`. Convention: prefer a
direct **parent-package bump** so it pulls the patched transitive dep;
use a `resolutions` entry **only** where no parent upgrade carries the
fix (or where the parent bump breaks CI).

## Changes

| Package | Change | Method | Advisories cleared |
|---|---|---|---|
| `react-router(-dom)` | `^6.4.4` → `^6.30.6` | direct bump (front, ui,
shared) | CVE-2026-53668 (open redirect → XSS) |
| `mintlify` | `^4.2.594` → `^4.2.790` | direct bump (twenty-docs) |
`@mintlify/cli` `adm-zip@0.6.0` (CVE-2026-39244) + `@mintlify/models`
`axios@1.18.0` |
| `sharp` | `0.34.5` → `0.35.3` | **scoped resolution**
`@argos-ci/core/sharp` | libvips CVE-2026-33327 / -33328 / -35590 /
-35591 |
| `next` | `→ 16.2.12` | scoped resolution `@react-email/ui/next` |
App-Router DoS / SSRF / open-redirect (CVE-2026-64641..64648) |
| `adm-zip` | `→ 0.6.0` | two scoped resolutions (zapier-cli,
module-federation) | CVE-2026-39244 |
| `nx` / `axios` | resolution **removed** | parent already fixed on
`main` | `nx@22.7.8` ships `axios@1.18.1` |
| `prosemirror-model` | deduped to a single `1.25.11` | `yarn dedupe` |
(not a vuln) `@mintlify/cli` pulled a 2nd copy that duplicated the
editor's prosemirror-model |

## Why sharp is a scoped resolution, not a parent bump

The only source of vulnerable `sharp@0.34.5` is `@argos-ci/core` (a
CI-only visual-testing tool, never shipped in a runtime image). Bumping
the parent `@argos-ci/storybook` to the sharp-patched `6.0.18` **breaks
CI**: its `argosVitestPlugin` (active only in the `modules`/`pages`
storybook shards) triggers TipTap bubble-menu `coordsAtPos`/`domFromPos`
errors while screenshotting editor stories, failing `front-sb-test (2,
modules)` (all tests pass; the job dies on the unhandled editor errors).
So `@argos-ci/storybook` stays at `6.0.6` and a scoped
`@argos-ci/core/sharp: 0.35.3` forces the patched sharp — argos-core
≥6.3.0 already uses `sharp ^0.35.2`, so 6.1.0 runs fine on 0.35.3.

## Resolutions that stay scoped (no clean parent bump)

- **`@argos-ci/core/sharp`** — see above (parent bump breaks CI).
- **`@react-email/ui/next`** — `@react-email/ui@6.9.2` pulls patched
`next@16.3.0` but drags a second `next` major into the tree; the scoped
pin dedupes onto the `16.2.12` twenty-website already resolves.
- **`zapier-platform-cli/adm-zip`** — latest `19.1.0` still pins
`adm-zip@0.5.16`.
- **`@module-federation/dts-plugin/adm-zip`** — fixed in
`dts-plugin@2.8.1`, gated behind an nx-23 jump.

## Verification

- Lockfile clean of every flagged version: no `sharp@0.34.5` (only
`0.35.2`/`0.35.3` + out-of-scope `0.33.5`); `adm-zip` only `0.6.0`;
`axios` ≥`1.18.0`; `next` only `16.2.12`.
- `yarn install --immutable` passes.
- `nx typecheck twenty-front` passes (twenty-server unaffected — no
runtime deps changed there).

## Notes / out of scope

- **react-router CVE-2026-53666 / -53669** — no 6.x backport (only fixed
in react-router 7). Moderate, ~2 months SLA. Deferred.
- **extract-zip CVE-2026-56876** — no upstream fix (unmaintained;
dev-only via puppeteer). Deferred.
- `@argos-ci` and `mintlify` are third-party **dev** dependencies, never
shipped in a runtime image.