Update dependencies and fix what the new lint rules caught

Every package moves to its newest in-major version, plus React 19.3, @convex-dev/auth 0.0.96 and next-plausible 4. The backend declares @auth/core and generates sign-in codes without oslo, which @convex-dev/auth no longer pulls in. The UseSend patch now actually removes the crypto import Convex refuses to bundle. The stricter react-hooks and typescript-eslint rules flagged the carousel, chart, image crop and mobile hook, which now pass.

apps/next/package.json

@@ -23,20 +23,21 @@
     "@convex-dev/auth": "catalog:convex",
     "@gib/backend": "workspace:*",
     "@gib/ui": "workspace:*",
-    "@payloadcms/db-postgres": "^3.80.0",
-    "@payloadcms/live-preview-react": "^3.80.0",
-    "@payloadcms/next": "^3.80.0",
-    "@payloadcms/richtext-lexical": "^3.80.0",
-    "@sentry/nextjs": "^10.46.0",
+    "@payloadcms/db-postgres": "^3.90.2",
+    "@payloadcms/live-preview-react": "^3.90.2",
+    "@payloadcms/next": "^3.90.2",
+    "@payloadcms/richtext-lexical": "^3.90.2",
+    "@sentry/nextjs": "^10.75.3",
     "@t3-oss/env-nextjs": "^0.13.11",
     "convex": "catalog:convex",
-    "next": "^16.2.1",
-    "next-plausible": "^3.12.5",
-    "payload": "^3.80.0",
+    "next": "^16.3.8",
+    "next-plausible": "^4.0.0",
+    "payload": "^3.90.2",
+    "posthog-js": "^1.435.6",
     "react": "catalog:react19",
     "react-dom": "catalog:react19",
     "require-in-the-middle": "^7.5.2",
-    "superjson": "2.2.3",
+    "superjson": "2.2.6",
     "ws": "catalog:",
     "zod": "catalog:"
   },
@@ -50,7 +51,7 @@
     "@types/node": "catalog:",
     "@types/react": "catalog:react19",
     "@types/react-dom": "catalog:react19",
-    "baseline-browser-mapping": "^2.10.11",
+    "baseline-browser-mapping": "^2.11.26",
     "eslint": "catalog:",
     "jsdom": "catalog:test",
     "prettier": "catalog:",

apps/next/payload-types.ts

@@ -137,6 +137,7 @@ export interface User {
   resetPasswordExpiration?: string | null;
   salt?: string | null;
   hash?: string | null;
+  resetPasswordRequestedAt?: string | null;
   loginAttempts?: number | null;
   lockUntil?: string | null;
   sessions?:
@@ -230,6 +231,7 @@ export interface UsersSelect<T extends boolean = true> {
   resetPasswordExpiration?: T;
   salt?: T;
   hash?: T;
+  resetPasswordRequestedAt?: T;
   loginAttempts?: T;
   lockUntil?: T;
   sessions?: