fix(deps): bump sharp to 0.35.3 for the libvips CVE fixes

sharp < 0.35.0 ships libvips 1.2.4, which carries CVE-2026-33327,
CVE-2026-33328, CVE-2026-35590 and CVE-2026-35591 (Dependabot #21).
0.35.3 bundles libvips 1.3.2 (8.18.3).

next 16.2.6 still declares sharp ^0.34.5 as an optional dependency, so a
plain bump left a nested vulnerable copy under node_modules/next that the
image optimizer would resolve first. The overrides entry pins a single
sharp across the tree; it can go once next ships >= 16.3 with sharp ^0.35.

package.json

@@ -50,7 +50,7 @@
     "react": "19.2.3",
     "react-dom": "19.2.3",
     "react-window": "^2.2.7",
-    "sharp": "^0.34.5",
+    "sharp": "^0.35.3",
     "sonner": "^2.0.7",
     "stripe": "^20.4.1",
     "tailwind-merge": "^3.4.0",
@@ -86,6 +86,9 @@
       "prettier --write"
     ]
   },
+  "overrides": {
+    "sharp": "^0.35.3"
+  },
   "ignoreScripts": [
     "sharp",
     "unrs-resolver"