Build: Replace mutable `latest` dependencies with explicit versions

[mssystem1]

Summary

The project uses mutable latest tags for production dependencies:

{
  "@supabase/ssr": "latest",
  "@supabase/supabase-js": "latest",
  "next": "latest"
}

At the same time, eslint-config-next is pinned to version 15.3.1.

Using latest makes builds non-reproducible because dependency versions depend on the package registry state rather than the repository revision.

Affected file(s)

package.json

https://github.com/circlefin/arc-commerce/blob/master/package.json

Steps to reproduce

1. Checkout a fixed commit.
2. Remove node_modules and package-lock.json.
3. Run:

npm install

4. Record installed package versions:

npm list next @supabase/ssr @supabase/supabase-js eslint-config-next

5. Repeat the installation after one of the dependencies publishes a new release.

Expected behavior

The same Git commit should always resolve to the same dependency versions.

Actual behavior

Dependency versions change over time because latest always resolves to the newest published release.

Impact

This may cause:

• Non-reproducible builds
• Unexpected framework upgrades
• Next.js compatibility issues
• CI inconsistencies
• Difficult bug reproduction
• Unexpected runtime behavior

Suggested fix

Replace latest with explicitly tested versions or controlled semver ranges.

Commit package-lock.json and use npm ci in CI.

Keep next and eslint-config-next aligned.

Checklist

• Remove latest from production dependencies
• Pin tested dependency versions
• Commit package-lock.json
• Use npm ci in CI
• Keep Next.js packages aligned