Upgrade Next.js to 16.4.6 and show locks on latest videos

- Upgrade next and eslint-config-next from 16.3.5 to 16.4.6. The older
  version has critical advisories, which made the Docker build's
  `pnpm audit --audit-level critical` step fail and blocked deploys.
- /api/videos/latest now reports whether the viewer can open each video;
  the dashboard shows a lock and the reason instead of opening the player.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>

lib/video-access.ts

@@ -30,7 +30,12 @@ const allowed = new Map<string, number>();
  * be open to them: first in its playlist, instant access, already unlocked, or
  * earned by completing the video before it.
  */
-export async function checkVideoAccess(viewer: Viewer, videoId: string): Promise<AccessResult> {
+export async function checkVideoAccess(
+  viewer: Viewer,
+  videoId: string,
+  // `peek` only answers the question (for listings); it records nothing.
+  opts: { peek?: boolean } = {}
+): Promise<AccessResult> {
   if (viewer.isAdmin) return { ok: true };
 
   const key = `${viewer.id}:${videoId}`;
@@ -41,7 +46,7 @@ export async function checkVideoAccess(viewer: Viewer, videoId: string): Promise
   const where = { userId_videoId: { userId: viewer.id, videoId } };
 
   if (check.ok) {
-    if (!check.free) {
+    if (!check.free && !opts.peek) {
       // Earned but never recorded (e.g. completed before unlocks were tracked).
       await prisma.videoUnlock.upsert({
         where,
@@ -56,7 +61,9 @@ export async function checkVideoAccess(viewer: Viewer, videoId: string): Promise
     if (!unlocked) return { ok: false, status: check.status, error: check.error };
   }
 
-  if (allowed.size >= MAX_ENTRIES) allowed.clear();
-  allowed.set(key, Date.now() + TTL_MS);
+  if (!opts.peek) {
+    if (allowed.size >= MAX_ENTRIES) allowed.clear();
+    allowed.set(key, Date.now() + TTL_MS);
+  }
   return { ok: true };
 }