fix: contact length limits + logger/next.config nitpicks + dep updates

- /api/contact enforces per-field length caps (name/email/subject/message)
  before sanitization/persistence; over-long message returns 400 without
  touching Mongo (test added)
- logger: crypto-based request id (randomUUID) instead of Math.random().substr;
  defaultMeta.version prefers DEPLOY_VERSION over npm_package_version
- next.config: move Turbopack svg rule from deprecated experimental.turbo to
  top-level turbopack
- deps: bump next 15.5.2 → 15.5.23; npm audit fix (19 → 3, remaining are
  transitive sharp/libvips DoS advisories, not exploitable for static images)

Closes MITHOME-78, MITHOME-79

proto/next.config.ts

@@ -14,15 +14,13 @@ const nextConfig: NextConfig = {
     ignoreBuildErrors: true,
   },
   
-  // Optimize for production builds
-  experimental: {
-    // Enable turbo mode for faster builds
-    turbo: {
-      rules: {
-        '*.svg': {
-          loaders: ['@svgr/webpack'],
-          as: '*.js',
-        },
+  // Optimize for production builds — Turbopack rules moved from the deprecated
+  // experimental.turbo to the top-level turbopack key (Next 15.5).
+  turbopack: {
+    rules: {
+      '*.svg': {
+        loaders: ['@svgr/webpack'],
+        as: '*.js',
       },
     },
   },