Pins nuxt and @nuxt/kit to the 3.16 line (resolves to 3.16.2) so installs
include the cache-poisoning DoS fix (GHSA-jvhm-gjrh-3h93) and updated
devtools transitive dependencies (e.g. simple-git GHSA-r275-fr43-pm7q).

Uses ~3.16.0 instead of ^3.16.0 to avoid unintentionally jumping to Nuxt
3.17+ during this security pass.

Made-with: Cursor

Coerce null asset gzipSize before matching so Bun snapshot matchers
(expect.any(Number)) work. Refresh Nuxt generate-bundle-stats snapshots
after the Nuxt ~3.16 upgrade; use Any<String> for bundler/plugin versions.

Made-with: Cursor