fix(web): truly pin lucide-react at 0.577.0

"lucide-react": "0" is npm shorthand for >=0.0.0 <1.0.0, so the
dependency was still floating across all 0.x releases. A future
lockfile refresh could pull a newer 0.x that quietly changes brand-icon
inventory.

Pin exact 0.577.0 (no caret) so the lockfile cannot drift until we
explicitly migrate to a brand-icon library compatible with lucide-react
v1.x (which removed Github, X, etc.).

Identified by cubic.

web/bun.lock

@@ -11,7 +11,7 @@
         "class-variance-authority": "^0.7.1",
         "clsx": "^2.1.1",
         "geist": "^1.7.0",
-        "lucide-react": "0",
+        "lucide-react": "0.577.0",
         "motion": "^12.38.0",
         "next": "16.2.6",
         "next-intl": "^4.11.0",

web/package.json

@@ -26,7 +26,7 @@
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "geist": "^1.7.0",
-    "lucide-react": "0",
+    "lucide-react": "0.577.0",
     "motion": "^12.38.0",
     "next": "16.2.6",
     "next-intl": "^4.11.0",