v1.6.7

Security:
- Next.js 15.5.18 -> 16.2.10 (multiple HIGH advisories: middleware/proxy
  bypass, Cache-Components DoS, SSRF via WebSocket upgrade, i18n proxy
  bypass, dynamic route param injection).
- Go 1.26.4 -> 1.26.5 for node probe (GO-2026-5856: ECH privacy leak in
  crypto/tls).

Features:
- Optional Cloudflare Turnstile on the /login form (opt-in via
  NEXT_PUBLIC_TURNSTILE_SITE_KEY + TURNSTILE_SECRET_KEY).
- New nodes get offline notifications enabled by default on first report
  (INSERT ... ON CONFLICT DO NOTHING, so operator edits are preserved).
- ServerDetail RealTime range now shows a fixed 5-minute sliding window,
  polling every 1.5s so the tail actually keeps up with the 5s sample rate.

Migrations:
- middleware.ts -> proxy.ts (Next 16 renamed the file convention).
- next.config.ts drops import.meta.url so Next 16's CJS-compiled config
  loads correctly.

Deps:
- lru-cache 11.5.1 -> 11.5.2, lucide-react 1.22 -> 1.23, tsx -> 4.23,
  @types/node -> 26.1.1.