chore(docs): update dependencies and adapt to zbsearch 4

fumadocs-core 16.14.5 switched its search engine from Orama to zbsearch 4,
so the panel docs follow it up to the same major.

zbsearch 4 still rejects locale codes as tokenizer languages ("en" throws,
only "english" is accepted), so the custom search dialog that forces an
English index stays necessary — verified by loading the built static index
for all four locales and searching it through fumadocs' own client.

Around that:
- use `staticClient`, as `oramaStaticClient` is now a deprecated alias
- drop @orama/orama, which nothing depends on or imports any more
- correct the two comments that still described Orama and pointed at its
  docs and tokenizer package, one of them suggesting a language zbsearch
  does not have
- restore the corepack integrity hash on `packageManager`, which CI reads
  through pnpm/action-setup
- prune minimumReleaseAgeExclude entries for versions no longer installed

The API reference MDX changes are serialization-only: fumadocs-openapi
11.2.4 emits plain scalars where it used folded ones. Parsed frontmatter
and page bodies are unchanged.

docs/content/docs/en/reference/api/authentication.mdx

@@ -1,8 +1,7 @@
 ---
 title: Authentication
-description: >-
-  Two authentication modes are supported. UI sessions use a cookie set by the
-  login endpoint. Programmatic clients (bots, scripts, remote panels)
+description: Two authentication modes are supported. UI sessions use a cookie
+  set by the login endpoint. Programmatic clients (bots, scripts, remote panels)
   authenticate with a Bearer token taken from Settings → Security → API Token.
   Both work for every endpoint under /panel/api/*.
 full: true
@@ -11,51 +10,38 @@ _openapi:
     - ./public/openapi.json
   toc:
     - depth: 2
-      title: >-
-        Authenticate with username + password and receive a session cookie.
+      title: Authenticate with username + password and receive a session cookie.
         Required before any cookie-based API call.
-      url: >-
-        #authenticate-with-username--password-and-receive-a-session-cookie-required-before-any-cookie-based-api-call
+      url: '#authenticate-with-username--password-and-receive-a-session-cookie-required-before-any-cookie-based-api-call'
     - depth: 2
       title: Clear the session cookie. Requires the CSRF header for browser sessions.
       url: '#clear-the-session-cookie-requires-the-csrf-header-for-browser-sessions'
     - depth: 2
-      title: >-
-        Mint a CSRF token for the current session. The SPA replays it in the
+      title: Mint a CSRF token for the current session. The SPA replays it in the
         X-CSRF-Token header on unsafe requests. Bearer-token callers can skip
         this — the middleware short-circuits CSRF for authenticated API
         requests.
-      url: >-
-        #mint-a-csrf-token-for-the-current-session-the-spa-replays-it-in-the-x-csrf-token-header-on-unsafe-requests-bearer-token-callers-can-skip-this--the-middleware-short-circuits-csrf-for-authenticated-api-requests
+      url: '#mint-a-csrf-token-for-the-current-session-the-spa-replays-it-in-the-x-csrf-token-header-on-unsafe-requests-bearer-token-callers-can-skip-this--the-middleware-short-circuits-csrf-for-authenticated-api-requests'
     - depth: 2
-      title: >-
-        Returns whether 2FA is enabled on the panel — used by the login page to
+      title: Returns whether 2FA is enabled on the panel — used by the login page to
         decide whether to show the OTP field.
-      url: >-
-        #returns-whether-2fa-is-enabled-on-the-panel--used-by-the-login-page-to-decide-whether-to-show-the-otp-field
+      url: '#returns-whether-2fa-is-enabled-on-the-panel--used-by-the-login-page-to-decide-whether-to-show-the-otp-field'
   structuredData:
     headings:
-      - content: >-
-          Authenticate with username + password and receive a session cookie.
+      - content: Authenticate with username + password and receive a session cookie.
           Required before any cookie-based API call.
-        id: >-
-          authenticate-with-username--password-and-receive-a-session-cookie-required-before-any-cookie-based-api-call
-      - content: >-
-          Clear the session cookie. Requires the CSRF header for browser
+        id: authenticate-with-username--password-and-receive-a-session-cookie-required-before-any-cookie-based-api-call
+      - content: Clear the session cookie. Requires the CSRF header for browser
           sessions.
         id: clear-the-session-cookie-requires-the-csrf-header-for-browser-sessions
-      - content: >-
-          Mint a CSRF token for the current session. The SPA replays it in the
+      - content: Mint a CSRF token for the current session. The SPA replays it in the
           X-CSRF-Token header on unsafe requests. Bearer-token callers can skip
           this — the middleware short-circuits CSRF for authenticated API
           requests.
-        id: >-
-          mint-a-csrf-token-for-the-current-session-the-spa-replays-it-in-the-x-csrf-token-header-on-unsafe-requests-bearer-token-callers-can-skip-this--the-middleware-short-circuits-csrf-for-authenticated-api-requests
-      - content: >-
-          Returns whether 2FA is enabled on the panel — used by the login page
-          to decide whether to show the OTP field.
-        id: >-
-          returns-whether-2fa-is-enabled-on-the-panel--used-by-the-login-page-to-decide-whether-to-show-the-otp-field
+        id: mint-a-csrf-token-for-the-current-session-the-spa-replays-it-in-the-x-csrf-token-header-on-unsafe-requests-bearer-token-callers-can-skip-this--the-middleware-short-circuits-csrf-for-authenticated-api-requests
+      - content: Returns whether 2FA is enabled on the panel — used by the login page to
+          decide whether to show the OTP field.
+        id: returns-whether-2fa-is-enabled-on-the-panel--used-by-the-login-page-to-decide-whether-to-show-the-otp-field
     contents: []
 ---