fix(web): patch Next 16.2.11 and stop Dependabot triple-counting

[kkopanidis]

Summary

• Patch the live site to Next.js 16.2.11 with npm overrides (undici, postcss, nanoid, js-yaml, brace-expansion, sharp) and Wrangler 4.125.0. apps/web npm audit is 0.
• Stop GitHub from counting ~375 duplicate alerts: drop Lerna and npm workspaces, delete the ghost Next 12 www tree from the root lockfile, and move Yarn into documentation/yarn.lock.
• Pin Docusaurus 3.9.2 transitives in the archive. Remaining high is image-size@2.0.2 (no patch) — dismiss as tolerable_risk after Dependabot rescans.

Cloudflare Pages (do this when merging)

Only archive.getconduit.dev (Pages). Leave getconduit.dev / Workers alone.

Change Pages build settings in the same sitting as merge (old settings break after this lands; new settings fail on current main):

Setting	Value
Root directory	documentation
Build command	yarn install --frozen-lockfile && yarn build
Output directory	build

Keep SKIP_DEPENDENCY_INSTALL=true and NODE_VERSION=24. Then retry the Pages build.

Test plan

• cd apps/web && npm ci --workspaces=false --install-strategy=nested && npm audit && npm run build
• cd documentation && yarn install --frozen-lockfile && yarn build
• CI: Web (unified site) and Docs (archive site) workflows
• After merge: Dependabot rescan; dismiss leftover image-size / unused webpack buildHttp / uuid@8 as tolerable_risk
• Cloudflare Pages cutover for archive.getconduit.dev as above

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	conduit-web	76ae561	Commit Preview URL Branch Preview URL	Aug 21 2026, 03:39 PM