fix: revert to next 15.4.11 (payload peer ceiling), record CVE risk acceptance

@payloadcms/next@3.90.2 peer-requires next <15.5.0; 15.5.27 was an
unsupported combo. Owner chose the pin + documented risk (SECURITY.md
§8). Transitive overrides (undici/sharp/postcss/sass) stay.
Gate skipped: parallel session WIP still in tree.

web/package.json

@@ -16,7 +16,7 @@
     "@payloadcms/db-postgres": "^3.60.0",
     "@payloadcms/next": "^3.60.0",
     "@payloadcms/richtext-lexical": "^3.60.0",
-    "next": "^15.5.27",
+    "next": "15.4.11",
     "payload": "^3.60.0",
     "react": "^19.2.0",
     "react-dom": "^19.2.0",