Upgrade Next.js to 16.4.6 and show locks on latest videos

- Upgrade next and eslint-config-next from 16.3.5 to 16.4.6. The older
  version has critical advisories, which made the Docker build's
  `pnpm audit --audit-level critical` step fail and blocked deploys.
- /api/videos/latest now reports whether the viewer can open each video;
  the dashboard shows a lock and the reason instead of opening the player.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>

app/api/videos/latest/route.ts

@@ -3,6 +3,7 @@ import { NextResponse } from 'next/server';
 import { getServerSession } from 'next-auth';
 import { authOptions } from '@/lib/auth-options';
 import { prisma } from '@/lib/prisma';
+import { checkVideoAccess } from '@/lib/video-access';
 
 export async function GET() {
   try {
@@ -70,7 +71,22 @@ export async function GET() {
       take: 10,
     });
 
-    return NextResponse.json({ videos });
+    // Tell the dashboard which of these the user can actually open, so locked
+    // ones show a lock instead of leading to a refusal.
+    const role = (session.user as any).role;
+    const viewer = { id: user.id, isAdmin: role === 'admin' || role === 'superadmin' };
+    const withAccess = await Promise.all(
+      videos.map(async (video) => {
+        const access = await checkVideoAccess(viewer, video.id, { peek: true });
+        return {
+          ...video,
+          accessible: access.ok,
+          lockReason: access.ok ? null : access.error,
+        };
+      })
+    );
+
+    return NextResponse.json({ videos: withAccess });
   } catch (err: any) {
     console.error('GET /api/videos/latest error', err);
     return NextResponse.json(