security: patch Next.js RCE vulnerability (CVE-2025-55182)

Upgrade Next.js from 16.0.8 to 16.0.10 to fix critical RCE
vulnerability (CVSS 10.0) in React Server Components.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

flake.nix

@@ -12,7 +12,7 @@
         pkgs = import nixpkgs { inherit system; };
 
         # NPM dependencies hash (update with: nix run nixpkgs#prefetch-npm-deps -- package-lock.json)
-        npmDepsHash = "sha256-bz8Q/d08FZtVElksXMvi90xrCCetTMQmzWCwU0W/vbg=";
+        npmDepsHash = "sha256-xmG0ej6GJk1HIFFmrB9CpovNA20sJ7RanFLMBCxKdy0=";
 
         # Import helpers
         mkViteApp = import ./nix/mkViteApp.nix {
@@ -111,7 +111,7 @@
           mkHackathonWithEnv = envVars: import ./nix/mkViteApp.nix {
             pkgs = final;
             src = self;
-            npmDepsHash = "sha256-bz8Q/d08FZtVElksXMvi90xrCCetTMQmzWCwU0W/vbg=";
+            npmDepsHash = "sha256-xmG0ej6GJk1HIFFmrB9CpovNA20sJ7RanFLMBCxKdy0=";
           } { name = "hackathon"; buildScript = "hackathon:build"; inherit envVars; };
         };
       };