fix(security): bump nodemailer to 9.0.1

Resolves the high-severity advisory (dependabot #20) where the
message-level raw option bypassed disableFileAccess/disableUrlAccess,
enabling arbitrary file read and SSRF. We only use the standard
createTransport/sendMail API, so the major bump is non-breaking.

bun.lock

@@ -20,7 +20,7 @@
         "next": "16.2.6",
         "next-auth": "^5.0.0-beta.30",
         "next-themes": "^0.4.6",
-        "nodemailer": "^8.0.5",
+        "nodemailer": "^9.0.1",
         "pg": "^8.18.0",
         "prisma": "^7.3.0",
         "radix-ui": "^1.4.3",
@@ -1455,7 +1455,7 @@
 
     "node-releases": ["[email protected]", "", {}, "sha512-nmh3lCkYZ3grZvqcCH+fjmQ7X+H0OeZgP40OierEaAptX4XofMh5kwNbWh7lBduUzCcV/8kZ+NDLCwm2iorIlA=="],
 
-    "nodemailer": ["nodemailer@8.0.5", "", {}, "sha512-0PF8Yb1yZuQfQbq+5/pZJrtF6WQcjTd5/S4JOHs9PGFxuTqoB/icwuB44pOdURHJbRKX1PPoJZtY7R4VUoCC8w=="],
+    "nodemailer": ["nodemailer@9.0.1", "", {}, "sha512-Gwv8SQewT616ZM/URn0H54b8PWo/Wum7md3EW2aWy1lO27+WZCX+Xyak3J+NlmHUjDh5ME+uesJUDRbR3Ye8Bw=="],
 
     "npm-run-path": ["[email protected]", "", { "dependencies": { "path-key": "^4.0.0" } }, "sha512-ppwTtiJZq0O/ai0z7yfudtBpWIoxM8yE6nHi1X47eFR2EWORqfbu6CnPlNsjeN683eT0qG6H/Pyf9fCcvjnnnQ=="],
 

package.json

@@ -43,7 +43,7 @@
     "next": "16.2.6",
     "next-auth": "^5.0.0-beta.30",
     "next-themes": "^0.4.6",
-    "nodemailer": "^8.0.5",
+    "nodemailer": "^9.0.1",
     "pg": "^8.18.0",
     "prisma": "^7.3.0",
     "radix-ui": "^1.4.3",