Upgrade Next.js to 16.4.3 and pin Node 24

Next 16.2.6 carried ~20 advisories fixed in 16.4.x, including
unauthenticated RCE in the Image Optimization API (GHSA-2xp9-vwfh-vxw4,
GHSA-2464-fhr4-w9xw) and SSG/ISR cache poisoning (GHSA-mcj8-r9mp-w47p).
npm audit fix clears the remaining sharp/postcss/source-map-js/nanoid
findings; npm audit now reports 0 vulnerabilities.

Node 20 is EOL and receives no fix for Node2Shell (CVE-2026-111497,
bundled Brotli decoder OOB write). Pin .nvmrc and render.yaml to Node 24
LTS; Amplify SSR compute runs the major version used at build time.

AMPLIFY_DEPLOY.md

@@ -171,7 +171,7 @@ significantly, the costs scale roughly linearly with Lambda invocations.
 ## When something breaks
 
 - **Build fails on `npm ci`** → usually a Node version mismatch. The
-  `.nvmrc` pins Node 20; if Amplify's build image doesn't have it, the
+  `.nvmrc` pins Node 24; if Amplify's build image doesn't have it, the
   `amplify.yml` `nvm install` falls back. Open the build log, search
   for "Node version".
 - **Build fails on `next build`** → typecheck or lint error. Reproduce