chore(deps): review-pass fixes — pin next 16.2.6, drop dead dep, dedupe three

- next 16.2.7 -> 16.2.6 in both apps. 16.2.7 regresses Turbopack dev route
  matching for API routes nested below a dynamic segment (probed in the
  private repo: /api/items/[id]/fork, /api/scenes/[id]/events 404 with the
  router's HTML not-found; production builds unaffected; bisected
  16.2.6 good / 16.2.7 bad). 16.2.6 carries all the 16.2.5/16.2.6
  security fixes — only the bugfix backports are forgone.
- Remove @react-three/uikit-lucide from @pascal-app/editor dependencies:
  zero imports in this repo or private-editor; dead weight in every npm
  consumer's install.
- Pin @visual-json/react "latest" -> "^0.4.0" (current resolution;
  "latest" in a published package's deps is unreproducible and was
  inconsistent with private-editor's ^0.4.0).
- Add root override three: 0.184.0, mirroring private-editor's dedupe —
  drops the nested stats-gl three@0.170.0 so the lockfile resolves a
  single three (the stated single-instance invariant now holds here too).

Verified: build, check-types, biome check, 931 package tests green;
lockfile resolves one next (16.2.6) and one three (0.184.0);
oxide/lightningcss optionalDependency pins still match resolutions.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

packages/editor/package.json

@@ -38,8 +38,7 @@
     "@radix-ui/react-switch": "^1.2.6",
     "@radix-ui/react-tabs": "^1.1.13",
     "@radix-ui/react-tooltip": "^1.2.8",
-    "@react-three/uikit-lucide": "^1.0.62",
-    "@visual-json/react": "latest",
+    "@visual-json/react": "^0.4.0",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "cmdk": "^1.1.1",