build: upgrade @hookform/resolvers to v7

CLAUDE.md

@@ -185,6 +185,7 @@ One GitHub release `agenthits-vX.Y.Z` covers a batch of work, not a single PR (o
 - Bun in all four Dockerfiles, and Nixpacks and Railpack in `Dockerfile` and in `pull-request.yml`, come from their GitHub releases through `scripts/github-release-asset.sh`, not from their install scripts. `github.com/<repo>/releases/download` answered 504 for hours on 2026-11-08 from every network, foreign proxies included, while `api.github.com` served the same files, and a few minutes later the API answered 502 to 504 as well, so the script tries github.com and then the API in up to six rounds 30 s apart, and refuses a file from the API whose SHA-256 differs from the `digest` GitHub records. The install scripts fetch from the same github.com URL, and a failed `curl | bash` runs nothing and still exits 0. `__test__/server/github-release-asset.test.ts` runs the script against a local server.
 - `sharp` and `@img/*` stay in `bun.lock` because `sharp` is an optional dependency of `next`. `images.unoptimized` in `next.config.mjs` turns off `/_next/image`, the only code that loads it, and the `prod-deps` stage of `Dockerfile` deletes both directories; `main-image-smoke` checks they are gone.
 - `apps/schedules` declares no `ioredis` of its own: the queues pass `connection` as plain options, and `bullmq` brings `ioredis` as an exact version. A direct `ioredis` at any other version leaves two copies in the lockfile.
+- `bullmq` stays on 5.x (owner's decision 2026-11-09): 6.0 removed the legacy repeatable jobs (`repeat` in `Queue#add`, `getRepeatableJobs`, `removeRepeatable`, `removeRepeatableByKey`) that `apps/schedules/src/queue.ts` is built on, made `ioredis` an optional peer and replaced `connection` with a `BackendFactory`. `apps/schedules` is upstream's cloud scheduler, which the fork's panel does not run (its schedules use node-schedule), and upstream itself is on bullmq 5.67, so a rewrite to job schedulers would only bring conflicts at each upstream sync. The `^5` range keeps minor and patch updates coming.
 - `inngest` stays at 4.26.1: 4.26.2 ships `sandbox-tool/dist/inngest-tool-linux-amd64`, built with Go 1.22, and the image scan fails on its Go stdlib findings. Move it when a release drops that binary or builds it with a current Go; do not add these findings to `.trivyignore.yaml`.
 - `ssh2` stays at 1.16.0: 1.17.0's native crypto module (`lib/protocol/crypto/src/binding.cc`) calls `v8::Context::GetIsolate()`, which Node 26's V8 no longer has, so `node-gyp` fails at install and ssh2 falls back to its JavaScript crypto. On Node that made 20 terminal open-and-close cycles of `__test__/wss/terminal-ssh-release.test.ts` take over 5 s instead of 1.9 s. Bun never loads the native module, 1.16.0 included, so the panel itself ran the same on both. Move it when a release builds on Node 26: `bindingAvailable` from `ssh2/lib/protocol/crypto.js` under `node` must be `true`.
 - Everything else takes a `^` range in every `package.json` that declares it, so the daily update moves it. A new exact version needs a line here saying why. On `0.x`, `^` narrows to patch (`^0.12.0` is `<0.13.0`), so a minor of `@xterm/addon-*`, `drizzle-zod` or another `0.x` package moves by hand.

apps/dokploy/package.json

@@ -68,7 +68,7 @@
 		"@dokploy/server": "workspace:*",
 		"@dokploy/trpc-openapi": "0.0.19",
 		"@faker-js/faker": "^10.6.0",
-		"@hookform/resolvers": "^5.9.2",
+		"@hookform/resolvers": "^7.0.5",
 		"@octokit/auth-app": "^8.3.1",
 		"@octokit/webhooks": "^14.2.0",
 		"@openpanel/nextjs": "^1.5.4",