fix: resolve npm audit vulnerabilities, upgrade to Next.js 16

AGENTS.md

@@ -12,6 +12,8 @@ the directory tree, so a package in a monorepo can add its own.
 
 ## Setup commands
 
+- This app runs on Next.js 16 — its APIs and conventions may differ from
+  older Next versions in your training data.
 - Install deps: `npm install`
 - Start dev server: `npm run dev`
 - Build: `npm run build`

app/vibenet/demos/b20/components/CopyPromptButton.tsx

@@ -20,7 +20,7 @@ type CopyPromptButtonProps = {
 // reusing the clipboard/check icons used elsewhere in the app.
 export function CopyPromptButton({ prompt, module, className }: CopyPromptButtonProps) {
   const [copied, setCopied] = useState(false);
-  const resetTimer = useRef<ReturnType<typeof setTimeout>>();
+  const resetTimer = useRef<ReturnType<typeof setTimeout>>(undefined);
 
   // Clear a pending "Copied" reset if the button unmounts before it fires.
   useEffect(() => () => clearTimeout(resetTimer.current), []);

eslint.config.mjs

@@ -0,0 +1,22 @@
+import { defineConfig } from "eslint/config";
+import nextCoreWebVitals from "eslint-config-next/core-web-vitals";
+
+export default defineConfig([
+  {
+    extends: [...nextCoreWebVitals],
+  },
+  {
+    // eslint-config-next 16 pulls in eslint-plugin-react-hooks v7, whose
+    // recommended preset promotes its new React Compiler diagnostics
+    // (set-state-in-effect, refs, purity, immutability, etc.) to errors.
+    // Codebase predates React Compiler adoption, so keep these as warnings
+    // until each is triaged rather than blocking the build on a dependency bump.
+    rules: {
+      "react-hooks/set-state-in-effect": "warn",
+      "react-hooks/refs": "warn",
+      "react-hooks/purity": "warn",
+      "react-hooks/immutability": "warn",
+      "react-hooks/preserve-manual-memoization": "warn",
+    },
+  },
+]);

next.config.mjs

@@ -7,13 +7,19 @@ const dir = path.dirname(fileURLToPath(import.meta.url));
 
 /** @type {import('next').NextConfig} */
 const nextConfig = {
+  // This repo hand-maintains AGENTS.md (see its own header); don't let
+  // `next dev` append its generated agent-rules block to it.
+  agentRules: false,
   // Keep tracing rooted at this checkout so a git worktree inside the repo
   // is not mistaken for a nested package of the parent lockfile.
   outputFileTracingRoot: dir,
   // Emit a self-contained server bundle (.next/standalone/server.js) so the
-  // internal Docker image can run the app without node_modules. Vercel
-  // ignores this and uses its own runtime, so it's a no-op there.
-  output: 'standalone',
+  // internal Docker image can run the app without node_modules. Vercel's
+  // runtime never uses this output, and generating it there has been
+  // failing the build outright (ENOENT on next-server.js.nft.json during
+  // Next 16's Turbopack file-tracing step) — so only opt into it for the
+  // internal build target that actually needs the standalone bundle.
+  ...(TARGET === 'internal' ? { output: 'standalone' } : {}),
 
   // Demos live under /vibenet/demos. They briefly sat at the top-level /demos,
   // whose paths were published in the sitemap and linked externally, so those