chore(deps): review-pass fixes — pin next 16.2.6, drop dead dep, dedupe three

- next 16.2.7 -> 16.2.6 in both apps. 16.2.7 regresses Turbopack dev route
  matching for API routes nested below a dynamic segment (probed in the
  private repo: /api/items/[id]/fork, /api/scenes/[id]/events 404 with the
  router's HTML not-found; production builds unaffected; bisected
  16.2.6 good / 16.2.7 bad). 16.2.6 carries all the 16.2.5/16.2.6
  security fixes — only the bugfix backports are forgone.
- Remove @react-three/uikit-lucide from @pascal-app/editor dependencies:
  zero imports in this repo or private-editor; dead weight in every npm
  consumer's install.
- Pin @visual-json/react "latest" -> "^0.4.0" (current resolution;
  "latest" in a published package's deps is unreproducible and was
  inconsistent with private-editor's ^0.4.0).
- Add root override three: 0.184.0, mirroring private-editor's dedupe —
  drops the nested stats-gl three@0.170.0 so the lockfile resolves a
  single three (the stated single-instance invariant now holds here too).

Verified: build, check-types, biome check, 931 package tests green;
lockfile resolves one next (16.2.6) and one three (0.184.0);
oxide/lightningcss optionalDependency pins still match resolutions.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

package.json

@@ -36,7 +36,8 @@
   "overrides": {
     "@types/react": "19.2.17",
     "@types/react-dom": "19.2.3",
-    "@types/three": "0.184.1"
+    "@types/three": "0.184.1",
+    "three": "0.184.0"
   },
   "optionalDependencies": {
     "@tailwindcss/oxide-darwin-arm64": "4.3.0",