chore(frontend): bump fumadocs docs deps to 16.15.7 only

[Copilot]

What & why

Bumps only the frontend docs app’s fumadocs-core and fumadocs-ui to 16.15.7, and updates the lockfile to resolve both exactly to 16.15.7 while keeping all intentionally held packages unchanged.

• Scope-limited bump
  • frontend/package.json
    • fumadocs-core: ^16.15.6 → ^16.15.7
    • fumadocs-ui: ^16.15.6 → ^16.15.7
• Lockfile alignment
  • frontend/pnpm-lock.yaml
    • importer specifiers updated to ^16.15.7
    • resolved versions updated to 16.15.7
    • transitive references updated accordingly
• Held versions preserved
  • No bumps to: lucide-react, next, react, react-dom, fumadocs-mdx, posthog-js, eslint, typescript, or other dependencies.

{
  "dependencies": {
    "fumadocs-core": "^16.15.7",
    "fumadocs-ui": "^16.15.7"
  }
}

Area

• Frontend
• Backend
• Scraper
• Convex
• Infra / tooling

How tested

• Regenerated frontend/pnpm-lock.yaml from updated frontend manifest and verified targeted dependency resolution is 16.15.7 for both packages.
• Verified diff scope is limited to frontend/package.json and frontend/pnpm-lock.yaml.

Security checklist

• Endpoints returning user data enforce ownership / authorization (N/A: frontend dependency-only change; no endpoint/auth logic touched).
• @auth_required is applied to routes that need authentication (N/A: no backend route changes).
• No SSRF: any outbound/scraped URL is validated (N/A: no URL-fetching logic changed).
• No secrets committed — no .env, *.db, keys, or credentials in the diff.
• Flask debug mode is not forced on in a production code path (N/A: no Flask/backend code changes).
• OAuth tokens stay encrypted at rest and are never logged or returned in responses (N/A: no token/auth handling changes).

Checks

• cd frontend && pnpm lint passes.
• Backend still starts and affected endpoints work (make dev-backend).

Original prompt

Dependency bump only for the frontend docs app.

In frontend/package.json and frontend/pnpm-lock.yaml, bump ONLY:

• fumadocs-core to 16.15.7 (currently resolved at 16.15.6)
• fumadocs-ui to 16.15.7 (currently resolved at 16.15.6)

Update package.json ranges to ^16.15.7 if present, then run pnpm install in frontend/ so the lockfile resolves both packages to exactly 16.15.7.

Do NOT bump: lucide-react, next, react, react-dom, fumadocs-mdx (defer major 15), posthog-js, eslint, typescript, or anything else.

Rationale: 16.15.7 cleared a ≥7-day supply-chain age gate; OSV clean. Newer 16.15.8/16.15.9 and lucide ≥1.42 / next 16.3.5 are intentionally held as too fresh.

PR body should list the bumps and the held packages.