chore(deps): review-pass fixes — pin next 16.2.6, drop dead dep, dedupe three

- next 16.2.7 -> 16.2.6 in both apps. 16.2.7 regresses Turbopack dev route
  matching for API routes nested below a dynamic segment (probed in the
  private repo: /api/items/[id]/fork, /api/scenes/[id]/events 404 with the
  router's HTML not-found; production builds unaffected; bisected
  16.2.6 good / 16.2.7 bad). 16.2.6 carries all the 16.2.5/16.2.6
  security fixes — only the bugfix backports are forgone.
- Remove @react-three/uikit-lucide from @pascal-app/editor dependencies:
  zero imports in this repo or private-editor; dead weight in every npm
  consumer's install.
- Pin @visual-json/react "latest" -> "^0.4.0" (current resolution;
  "latest" in a published package's deps is unreproducible and was
  inconsistent with private-editor's ^0.4.0).
- Add root override three: 0.184.0, mirroring private-editor's dedupe —
  drops the nested stats-gl three@0.170.0 so the lockfile resolves a
  single three (the stated single-instance invariant now holds here too).

Verified: build, check-types, biome check, 931 package tests green;
lockfile resolves one next (16.2.6) and one three (0.184.0);
oxide/lightningcss optionalDependency pins still match resolutions.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/editor/package.json

@@ -25,7 +25,7 @@
     "clsx": "^2.1.1",
     "geist": "^1.7.0",
     "lucide-react": "^1.7.0",
-    "next": "16.2.7",
+    "next": "16.2.6",
     "postcss": "^8.5.6",
     "react": "^19.2.4",
     "react-dom": "^19.2.4",

apps/ifc-converter/package.json

@@ -23,7 +23,7 @@
     "@react-three/fiber": "^9.5.0",
     "@tailwindcss/postcss": "^4.2.1",
     "clsx": "^2.1.1",
-    "next": "16.2.7",
+    "next": "16.2.6",
     "postcss": "^8.5.6",
     "react": "^19.2.4",
     "react-dom": "^19.2.4",