[codex] Fix dependency audit vulnerabilities

[rgilks]

Summary

• upgrade vulnerable Next.js, OpenNext Cloudflare, Wrangler, Drizzle, Vitest, and transitive audit dependencies
• add server-side bounds for saved game payloads and make persisted Zustand storage SSR-safe
• stabilize e2e smoke tests by waiting for async DB saves and running the shared local DB suite serially
• run PR CI on pull requests while keeping Cloudflare deploy restricted to main pushes

Validation

• npm audit --json: 0 vulnerabilities
• npm run check
• npm run build
• manual browser smoke on localhost:3006: classic mode, board render, dice roll, help open/close, no console errors