fix(patches): include preview-props.json in loadManifest glob for Next.js 16.4 - #1356

- Add @opennextjs/cloudflare and wrangler config (Smart Placement,
  Hyperdrive binding, observability).
- Replace the global `db` with `getDb()`: one Hyperdrive-backed client per
  request on Workers (sockets can't cross requests), the DATABASE_URL client
  everywhere else. next-auth now builds its config per request.
- Set `trustHost` so Auth.js accepts the Worker's hostname.
- Pin Next to 16.3.x: the adapter 500s on 16.4 until
  opennextjs/opennextjs-cloudflare#1356 ships; Dependabot ignores 16.4+.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01LcV53ESAdFnYAbNewkMuUD

…#25118)

`@opennextjs/cloudflare` throws on the new `preview-props.json` manifest
that Next.js 16.4 loads, so every request in the `(latest)` variant
returns a 500
(opennextjs/opennextjs-cloudflare#1355).

This pins the variant to 16.3 until the upstream fix
(opennextjs/opennextjs-cloudflare#1356) is
released, and we should switch it back to `next@latest` then.

Co-authored-by: Claude Opus 5.5 <[email protected]>

…props.json manifest

Live site was crashing on every request with Error 1101 ("Unexpected
loadManifest(/.next/server/preview-props.json) call!"). Next.js's
NextNodeServer constructor unconditionally calls getPreviewProps(),
which loads .next/server/preview-props.json — a manifest the installed
@opennextjs/[email protected] doesn't yet know is safe to be missing,
so its patched loadManifest() throws instead of returning {} like
Next.js's own handleMissing:true behavior. Upstream fix is open but
unreleased: opennextjs/opennextjs-cloudflare#1356

Reproduced the exact crash locally via `wrangler dev --local` against
an unpatched build, confirmed the patch resolves it, confirmed /, /shop
and /sign-in all return 200 against the patched build.

Also commits a proper wrangler.jsonc + open-next.config.ts (previously
regenerated fresh via an interactive migrate flow on every single CI
deploy, since neither was in version control) so @opennextjs/cloudflare
is pinned and patched consistently instead of drifting between builds.
patch-package reapplies the fix automatically via postinstall.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

Next 16.4 で増えた .next/server/preview-props.json を、@opennextjs/cloudflare が
manifest として Worker に埋め込まず、起動時に例外になっていた。upstream の修正
（opennextjs/opennextjs-cloudflare#1356）が出るまで、ビルド直前に glob へ足す。
あわせて、Next 16.3 以降の cache handler のパッチが直った 1.20.10 に上げる。

Co-authored-by: Claude Opus 5.5 <[email protected]>

Next.js 16.4.0 moved preview props into a separate
`.next/server/preview-props.json` manifest that
`NextNodeServer.getPreviewProps()` loads unconditionally during server
construction. OpenNext's build-time `loadManifest` inliner only globs
`{*-manifest,required-server-files,prefetch-hints}.json`, so the call
fell through to `throw new Error("Unexpected loadManifest(...) call!")`
and the bts-web worker failed on every request (even GET /favicon.ico).

Patch @opennextjs/[email protected] so the glob also matches
`preview-props.json`, mirroring upstream
opennextjs/opennextjs-cloudflare#1356. The patch is version-pinned to
1.20.9 so it stops applying once the adapter is upgraded.

Verified locally with `wrangler dev`: GET / and /docs return 200 with no
`loadManifest` errors; `bun install --frozen-lockfile` reapplies the
patch on a clean install.