chore(deps): SvelteKit 3 with adapter-static 4 and TypeScript 6, full-tree npm audit (#5021)

Merges Renovate's kit 3 (PR #149) and adapter-static 4 (PR #148) bumps,
plus the migration they need. The mechanical part is `sv migrate
sveltekit-3`, run one task at a time and reviewed:

- svelte.config.js is gone. Its options move into sveltekit() in
  vite.config.ts, exported as kitOptions so vitest.config.ts runs the
  same kit setup, including the $test-utils alias the tests import.
- $lib becomes #lib through package.json "imports". There is no
  src/lib/index, so only the "#lib/*" entry is kept.
- tsconfig extends $app/tsconfig.
- Peer floors raised to kit 3's requirements: svelte ^5.57.1, vite
  ^8.0.12, svelte-check ^4.7.5.

By hand, from the codemod's list of non-automated tasks:

- goto's replaceState option is now replace; keepFocus becomes
  reset: false. For the search typeahead, reset: false also stops the
  scroll-to-top, which is wanted while typing.
- The test setup mocks drop pushState/replaceState and $app/paths
  base/assets, which kit 3 removed, and mock refreshAll in place of
  invalidateAll.
- The other flagged files only read page.url or goto internal routes,
  so they needed no change.

TypeScript goes to ^6, not the ^7 Renovate offers: kit 3 declares
typescript ^6 as a peer and svelte-check 4.7 accepts ^5 || ^6. Move to
7 once both accept it.

With Tailwind 4 and kit 3 in, `npm audit` on the whole tree reports 0,
so the web lane now audits every dependency rather than only what
ships to browsers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/src/lib/player/audioLoader.test.ts

@@ -1,5 +1,5 @@
 import { afterEach, describe, expect, test, vi } from 'vitest';
-import type { TrackRef } from '$lib/api/types';
+import type { TrackRef } from '#lib/api/types.js';
 import { audioLoader, setAudioLoader, __resetAudioLoader } from './audioLoader';
 
 const sampleTrack: TrackRef = {

web/src/lib/player/audioLoader.ts

@@ -9,7 +9,7 @@
 //   no-op (the browser handles it via the prefetch <audio> element);
 //   Tauri can warm its native cache here.
 
-import type { TrackRef } from '$lib/api/types';
+import type { TrackRef } from '#lib/api/types.js';
 
 export type AudioLoader = {
   resolve: (track: TrackRef) => string;

web/src/lib/player/events.svelte.test.ts

@@ -1,7 +1,7 @@
 import { afterEach, beforeEach, describe, expect, test, vi } from 'vitest';
 import { flushSync } from 'svelte';
 
-vi.mock('$lib/api/client', () => ({
+vi.mock('#lib/api/client.js', () => ({
   api: {
     post: vi.fn().mockResolvedValue({ play_event_id: 'pe-1', session_id: 's-1' })
   }
@@ -19,8 +19,8 @@ import {
   reportDuration,
   skipNext,
 } from './store.svelte';
-import { api } from '$lib/api/client';
-import type { TrackRef } from '$lib/api/types';
+import { api } from '#lib/api/client.js';
+import type { TrackRef } from '#lib/api/types.js';
 import { makeTrack } from '$test-utils/fixtures/track';
 
 function track(id: string, dur = 200): TrackRef {

web/src/lib/player/events.svelte.ts

@@ -1,7 +1,7 @@
 import { player } from './store.svelte';
-import { api } from '$lib/api/client';
+import { api } from '#lib/api/client.js';
 import { getOrCreateClientId } from './clientId';
-import type { PlayStartedResponse, EventOkResponse } from '$lib/api/types';
+import type { PlayStartedResponse, EventOkResponse } from '#lib/api/types.js';
 
 // useEventsDispatcher installs $effect-based watchers that emit play events
 // to /api/events. Call once from +layout.svelte's mount.

web/src/lib/player/gain.test.ts

@@ -1,7 +1,7 @@
 import { describe, expect, test } from 'vitest';
 import { dbToLinear, gainDb, playingAsAlbum, MAX_BOOST_DB } from './gain';
-import type { NormalizationPrefs } from '$lib/api/normalization';
-import type { TrackRef } from '$lib/api/types';
+import type { NormalizationPrefs } from '#lib/api/normalization.js';
+import type { TrackRef } from '#lib/api/types.js';
 import { makeTrack } from '$test-utils/fixtures/track';
 
 const prefs = (over: Partial<NormalizationPrefs> = {}): NormalizationPrefs => ({

web/src/lib/player/gain.ts

@@ -1,8 +1,8 @@
 // Loudness normalization math for the web player (M464 #4999). Pure, so the
 // rules are tested without an <audio> element or an AudioContext.
 
-import type { NormalizationPrefs, ReplayGain } from '$lib/api/normalization';
-import type { TrackRef } from '$lib/api/types';
+import type { NormalizationPrefs, ReplayGain } from '#lib/api/normalization.js';
+import type { TrackRef } from '#lib/api/types.js';
 
 // The server's gains are to the ReplayGain 2.0 reference.
 const REFERENCE_LUFS = -18;

web/src/lib/player/gainStage.svelte.test.ts

@@ -1,8 +1,8 @@
 import { beforeEach, describe, expect, test, vi } from 'vitest';
-import type { TrackRef } from '$lib/api/types';
+import type { TrackRef } from '#lib/api/types.js';
 import { makeTrack } from '$test-utils/fixtures/track';
 
-vi.mock('$lib/auth/store.svelte', () => ({
+vi.mock('#lib/auth/store.svelte.js', () => ({
   user: {
     get value() {
       return { id: 'test-user' };
@@ -11,8 +11,8 @@ vi.mock('$lib/auth/store.svelte', () => ({
 }));
 
 const getReplayGain = vi.fn();
-vi.mock('$lib/api/normalization', async (orig) => ({
-  ...(await orig<typeof import('$lib/api/normalization')>()),
+vi.mock('#lib/api/normalization.js', async (orig) => ({
+  ...(await orig<typeof import('#lib/api/normalization.js')>()),
   getReplayGain: (ids: string[]) => getReplayGain(ids)
 }));
 

web/src/lib/player/gainStage.svelte.ts

@@ -10,8 +10,8 @@
 // what the track sounded like before leveling existed.
 
 import { SvelteMap } from 'svelte/reactivity';
-import { getReplayGain, type ReplayGain } from '$lib/api/normalization';
-import { normalization } from '$lib/stores/normalization.svelte';
+import { getReplayGain, type ReplayGain } from '#lib/api/normalization.js';
+import { normalization } from '#lib/stores/normalization.svelte.js';
 import { player } from './store.svelte';
 import { dbToLinear, gainDb, playingAsAlbum } from './gain';
 

web/src/lib/player/mediaSession.svelte.test.ts

@@ -1,6 +1,6 @@
 import { afterEach, beforeEach, describe, expect, test, vi } from 'vitest';
 import { flushSync } from 'svelte';
-import type { TrackRef } from '$lib/api/types';
+import type { TrackRef } from '#lib/api/types.js';
 import { makeTrack } from '$test-utils/fixtures/track';
 
 function track(id: string): TrackRef {

web/src/lib/player/mediaSession.svelte.ts

@@ -1,4 +1,4 @@
-import { coverUrl } from '$lib/media/covers';
+import { coverUrl } from '#lib/media/covers.js';
 import {
   player,
   togglePlay,

web/src/lib/player/persisted.ts

@@ -1,4 +1,4 @@
-import type { TrackRef } from '$lib/api/types';
+import type { TrackRef } from '#lib/api/types.js';
 
 export type PersistedPlayerState = {
   v: 1;

web/src/lib/player/shortcuts.svelte.test.ts

@@ -1,6 +1,6 @@
 import { afterEach, beforeEach, describe, expect, test } from 'vitest';
 import { flushSync } from 'svelte';
-import type { TrackRef } from '$lib/api/types';
+import type { TrackRef } from '#lib/api/types.js';
 import { makeTrack } from '$test-utils/fixtures/track';
 
 function track(id: string): TrackRef {

web/src/lib/player/store.svelte.ts

@@ -1,9 +1,9 @@
-import type { TrackRef, RadioResponse } from '$lib/api/types';
+import type { TrackRef, RadioResponse } from '#lib/api/types.js';
 import { untrack } from 'svelte';
-import { api } from '$lib/api/client';
-import { user } from '$lib/auth/user.svelte';
-import { sessionEnd } from '$lib/auth/sessionEnd.svelte';
-import * as storage from '$lib/util/safeLocalStorage';
+import { api } from '#lib/api/client.js';
+import { user } from '#lib/auth/user.svelte.js';
+import { sessionEnd } from '#lib/auth/sessionEnd.svelte.js';
+import * as storage from '#lib/util/safeLocalStorage.js';
 import { readPersistedQueue, writePersistedQueue, clearPersistedQueue } from './persisted';
 
 export type PlayerState = 'idle' | 'loading' | 'playing' | 'paused' | 'error';

web/src/lib/player/store.test.ts

@@ -17,11 +17,11 @@ import {
   __setShuffleRng,
   restoreQueue
 } from './store.svelte';
-import type { TrackRef } from '$lib/api/types';
+import type { TrackRef } from '#lib/api/types.js';
 import { writePersistedQueue, clearPersistedQueue } from './persisted';
 import { makeTrack } from '$test-utils/fixtures/track';
 
-vi.mock('$lib/auth/store.svelte', () => ({
+vi.mock('#lib/auth/store.svelte.js', () => ({
   user: {
     get value() {
       return { id: 'test-user' };
@@ -345,7 +345,7 @@ import {
   toggleQueueDrawer,
   closeQueueDrawer
 } from './store.svelte';
-import * as client from '$lib/api/client';
+import * as client from '#lib/api/client.js';
 
 describe('player store — enqueue + playRadio', () => {
   test('enqueueTrack appends to a non-empty queue, _index unchanged', () => {