Bump next 15.1.6 -> 15.5.18 in frontend/nextjs

[Gabrielpanga]

Summary

Same-major bump of next in frontend/nextjs to clear the critical and one high advisory.

Before

• 4 vulnerabilities (1 critical, 1 high, 2 moderate)
  • Critical: Information exposure in Next.js dev server due to lack of origin verification
  • High: Next.JS DoS via cache poisoning
  • 2 transitive moderate advisories

After

• 4 vulnerabilities (0 critical, 1 high, 3 moderate)
  • 1 high remaining: jsonwebtoken via pluggy-sdk 0.31.1 — needs a major pluggy-sdk bump (separate PR)
  • 3 moderate (next/postcss, pluggy-sdk/jsonwebtoken transitive)

Net: criticals cleared. The remaining high is gated on a major migration tracked elsewhere.

Change

- "next": "15.1.6"
+ "next": "15.5.18"

Same-major (15.x), non-breaking per Next.js release notes.

Test plan

• npm ci succeeds in frontend/nextjs
• npm run build succeeds
• npm run dev boots and the demo connect token flow works