fix: contact length limits + logger/next.config nitpicks + dep updates

- /api/contact enforces per-field length caps (name/email/subject/message)
  before sanitization/persistence; over-long message returns 400 without
  touching Mongo (test added)
- logger: crypto-based request id (randomUUID) instead of Math.random().substr;
  defaultMeta.version prefers DEPLOY_VERSION over npm_package_version
- next.config: move Turbopack svg rule from deprecated experimental.turbo to
  top-level turbopack
- deps: bump next 15.5.2 → 15.5.23; npm audit fix (19 → 3, remaining are
  transitive sharp/libvips DoS advisories, not exploitable for static images)

Closes MITHOME-78, MITHOME-79

proto/src/lib/logger.ts

@@ -1,5 +1,6 @@
 import winston from 'winston'
 import LokiTransport from 'winston-loki'
+import { randomUUID } from 'crypto'
 
 const isDevelopment = process.env.NODE_ENV === 'development'
 
@@ -64,7 +65,7 @@ export const logger = winston.createLogger({
   format: structuredFormat,
   defaultMeta: {
     service: 'mozdit-web',
-    version: process.env.npm_package_version || '1.0.0',
+    version: process.env.DEPLOY_VERSION || process.env.npm_package_version || '1.0.0',
     environment: process.env.NODE_ENV || 'development'
   },
   transports,
@@ -85,7 +86,7 @@ export const errorLogger = logger.child({ component: 'error' })
 
 // Request ID generator for correlation
 export const generateRequestId = (): string =>
-  `${Date.now()}-${Math.random().toString(36).substr(2, 9)}`
+  `${Date.now()}-${randomUUID().slice(0, 8)}`
 
 // Helper function for timing operations
 export const withTiming = async <T>(