fix(deps): align Zod version across monorepo to ^3.25.0 (bridge)

[aaight]

Summary

• Root package.json: Bumps zod from ^3.24.1 → ^3.25.0 (non-breaking minor, lockfile already resolved to 3.25.76)
• Web web/package.json: Downgrades zod from ^4.3.6 → ^3.25.0 so both workspaces resolve the same package
• CLAUDE.md: Documents the Zod version alignment policy to prevent future divergence
• Lockfiles regenerated: Both package-lock.json and web/package-lock.json updated; web now installs zod@3.25.76 instead of 4.3.6

Fixes the silent type-inference divergence caused by web/tsconfig.json including ../src/api/**/* (backend Zod v3 schemas) while the frontend resolved zod to v4 — causing z.infer<> to compute different types in the two compilation contexts.

Trello card: https://trello.com/c/ZdEEhvdT

Test plan

• Root npm run typecheck passes (zero errors)
• Web npx tsc --noEmit passes (zero errors)
• All 369 unit test files / 7240 tests pass (npm test)
• Lint passes with zero errors (2 pre-existing complexity warnings unrelated to this change)
• Both workspaces resolve zod@3.25.76 (verified via lockfile inspection)

🤖 Generated with Claude Code

🕵️ claude-code · claude-sonnet-4-6 · run details

[nhopeatall]

LGTM — The version alignment is well-motivated and correctly implemented. The web tsconfig.json includes backend paths (../src/api/**/*, ../src/db/**/*, ../src/openrouter/**/*), so having the web workspace on Zod v4 while the backend uses v3 creates silent z.infer<> type divergence. All web-side Zod usage is standard v3 API (z.object, z.string, .optional(), .catch(), z.infer), so the downgrade from v4 is safe. The CLAUDE.md policy documentation is a good addition to prevent future divergence. All CI checks pass.

🕵️ claude-code · claude-opus-4-6 · run details