Upgrade Next.js to 16.2.9

[clbotdev]

Closes #802

Summary

• Bump next from ^16.0.10 to ^16.2.9 and eslint-config-next to ^16.2.9 in apps/web/package.json
• Fix TypeScript errors in test files exposed by stricter Mongoose lean() return types in this Next.js version:
  • Cast findOne().lean() results to any where the union type T[] | T blocked property access
  • Cast course.courseId to any where ObjectId & string was expected
  • Add non-null assertion on groups! where CourseModel.create() result has optional field typing
  • Use as unknown as jest.Mock for better-auth session casts that no longer overlap with Mock<any,any,any>
  • Cast membership as any when checking a property set by the function under test

Test plan

• pnpm --filter @courselit/web exec tsc --noEmit --skipLibCheck — no errors
• pnpm test — 641 tests passing across 79 test suites
• pnpm lint — no lint errors
• pnpm prettier — no formatting changes

🤖 Generated with Claude Code