web: upgrade to next 16.3.3 and typescript 7, cache turbopack builds in docker

web/next.config.mjs

@@ -27,6 +27,13 @@ const nextConfig = {
   turbopack: {
     root: __dirname,
   },
+  experimental: {
+    // `typescript` is aliased to the TS6 API package (typescript-eslint can't
+    // use TS7's native compiler yet), which has no `tsc` bin for the 16.3 CLI
+    // checker — type-check builds through the TS6 JS API instead. `npx tsc`
+    // (CI, manual) runs native TS7 via @typescript/native.
+    useTypeScriptCli: false,
+  },
 };
 
 export default nextConfig;