Trim oversized bento images + fix sizes; bump turbo (clears advisories)

- Cap the two wildly oversized bento source PNGs so Next can't serve giant variants:
  occupy-wallets 1200x837/393K -> 700x488/167K, neroswap 1584x672/1.8M -> 700x297/404K.
  (bauhaus/vegan are already 512px and self-cap; privacy-labs was already small.)
- Fix the bento <Image> sizes: object-contain height-constrains the image so it renders
  ~360px wide in either span; 66vw/100vw made Next serve up to ~750-1200w. Now
  '(max-width:768px) 90vw, 33vw'.
- Bump turbo 2.7.4 -> 2.9.16 (GHSA-hcf7-66rw-9f5r, GHSA-3qcw-2rhx-2726). pnpm audit
  now clean.

apps/web/src/components/portfolio/bento-grid.tsx

@@ -67,7 +67,9 @@ function BentoCard({ item, delay }: { item: Item; delay: number }) {
           alt={item.alt}
           fill
           className="object-contain p-2 opacity-60 transition-transform duration-1000 group-hover:scale-105"
-          sizes={item.span === 2 ? "(max-width: 768px) 100vw, 66vw" : "(max-width: 768px) 100vw, 33vw"}
+          {/* object-contain height-constrains the image, so it renders ~the same width
+              in either span (~360px); 66vw/100vw made Next serve up to ~750-1200w. */}
+          sizes="(max-width: 768px) 90vw, 33vw"
         />
       </div>
     </Card>