fix(api): bump fastify 5.6→5.8 and @trpc/{server,client} 11.6→11.16

Addresses two HIGH-severity CVEs found via Trivy scan on a self-hosted
deployment:

- fastify 5.6.1 → 5.8.5: fixes CVE-2026-25223 (validation bypass via
  malformed Content-Type header). Attacker can bypass Fastify's request
  schema validation by crafting the Content-Type header, potentially
  sending malformed payloads to validated endpoints like /track.

- @trpc/server 11.6.0 → 11.16.0: fixes CVE-2025-68130 (prototype
  pollution in experimental_nextAppDirCaller). Lower risk since
  openpanel may not use that API, but the bump is semver-compatible
  and brings other stability fixes.

Also aligns @trpc/client to 11.16.0 across all packages (was 11.6.0
in packages/trpc and apps/start) so client and server stay on the same
minor — mismatched versions can cause subtle serialization bugs.

Both are ^-ranged deps — pnpm update resolves to latest compatible.
Verified: `pnpm --filter @openpanel/api build` succeeds.

Author: raonitimo

apps/api/package.json

@@ -40,9 +40,9 @@
     "@openpanel/redis": "workspace:*",
     "@openpanel/trpc": "workspace:*",
     "@openpanel/validation": "workspace:*",
-    "@trpc/server": "^11.6.0",
+    "@trpc/server": "^11.16.0",
     "fast-json-stable-hash": "^1.0.3",
-    "fastify": "^5.6.1",
+    "fastify": "^5.8.5",
     "fastify-metrics": "^12.1.0",
     "fastify-raw-body": "^5.0.0",
     "fastify-zod-openapi": "^5.6.1",

apps/start/package.json

@@ -82,9 +82,9 @@
     "@tanstack/react-virtual": "^3.13.12",
     "@tanstack/router-plugin": "^1.132.56",
     "@tanstack/store": "^0.8.0",
-    "@trpc/client": "^11.6.0",
+    "@trpc/client": "^11.16.0",
     "@trpc/react-query": "^11.6.0",
-    "@trpc/server": "^11.6.0",
+    "@trpc/server": "^11.16.0",
     "@trpc/tanstack-react-query": "^11.6.0",
     "@types/d3": "^7.4.3",
     "bind-event-listener": "^3.0.0",

packages/trpc/package.json

@@ -20,8 +20,8 @@
     "@openpanel/validation": "workspace:*",
     "@openpanel/queue": "workspace:*",
     "@trpc-limiter/redis": "^0.0.2",
-    "@trpc/client": "^11.6.0",
-    "@trpc/server": "^11.6.0",
+    "@trpc/client": "^11.16.0",
+    "@trpc/server": "^11.16.0",
     "date-fns": "^3.3.1",
     "mathjs": "^12.3.2",
     "prisma-error-enum": "^0.1.3",