chore(deps): SvelteKit 3 with adapter-static 4 and TypeScript 6, full-tree npm audit (#5021)

Merges Renovate's kit 3 (PR #149) and adapter-static 4 (PR #148) bumps,
plus the migration they need. The mechanical part is `sv migrate
sveltekit-3`, run one task at a time and reviewed:

- svelte.config.js is gone. Its options move into sveltekit() in
  vite.config.ts, exported as kitOptions so vitest.config.ts runs the
  same kit setup, including the $test-utils alias the tests import.
- $lib becomes #lib through package.json "imports". There is no
  src/lib/index, so only the "#lib/*" entry is kept.
- tsconfig extends $app/tsconfig.
- Peer floors raised to kit 3's requirements: svelte ^5.57.1, vite
  ^8.0.12, svelte-check ^4.7.5.

By hand, from the codemod's list of non-automated tasks:

- goto's replaceState option is now replace; keepFocus becomes
  reset: false. For the search typeahead, reset: false also stops the
  scroll-to-top, which is wanted while typing.
- The test setup mocks drop pushState/replaceState and $app/paths
  base/assets, which kit 3 removed, and mock refreshAll in place of
  invalidateAll.
- The other flagged files only read page.url or goto internal routes,
  so they needed no change.

TypeScript goes to ^6, not the ^7 Renovate offers: kit 3 declares
typescript ^6 as a peer and svelte-check 4.7 accepts ^5 || ^6. Move to
7 once both accept it.

With Tailwind 4 and kit 3 in, `npm audit` on the whole tree reports 0,
so the web lane now audits every dependency rather than only what
ships to browsers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/src/routes/albums/[id]/+page.svelte

@@ -1,21 +1,21 @@
 <script lang="ts">
   import { Play, Shuffle } from 'lucide-svelte';
   import { page } from '$app/state';
-  import { createAlbumQuery } from '$lib/api/queries';
-  import { qk } from '$lib/api/queries';
-  import { pageTitle } from '$lib/branding';
-  import TrackRow from '$lib/components/TrackRow.svelte';
-  import LibrarySkeleton from '$lib/components/LibrarySkeleton.svelte';
-  import ApiErrorBanner from '$lib/components/ApiErrorBanner.svelte';
-  import LikeButton from '$lib/components/LikeButton.svelte';
-  import { useDelayed } from '$lib/utils/useDelayed.svelte';
-  import { formatDuration } from '$lib/media/duration';
-  import { FALLBACK_COVER } from '$lib/media/covers';
-  import type { ApiError } from '$lib/api/client';
-  import { playQueue } from '$lib/player/store.svelte';
-  import { user } from '$lib/auth/store.svelte';
-  import { refetchAlbumCover } from '$lib/api/admin';
-  import { errCode } from '$lib/api/errors';
+  import { createAlbumQuery } from '#lib/api/queries.js';
+  import { qk } from '#lib/api/queries.js';
+  import { pageTitle } from '#lib/branding.js';
+  import TrackRow from '#lib/components/TrackRow.svelte';
+  import LibrarySkeleton from '#lib/components/LibrarySkeleton.svelte';
+  import ApiErrorBanner from '#lib/components/ApiErrorBanner.svelte';
+  import LikeButton from '#lib/components/LikeButton.svelte';
+  import { useDelayed } from '#lib/utils/useDelayed.svelte.js';
+  import { formatDuration } from '#lib/media/duration.js';
+  import { FALLBACK_COVER } from '#lib/media/covers.js';
+  import type { ApiError } from '#lib/api/client.js';
+  import { playQueue } from '#lib/player/store.svelte.js';
+  import { user } from '#lib/auth/store.svelte.js';
+  import { refetchAlbumCover } from '#lib/api/admin.js';
+  import { errCode } from '#lib/api/errors.js';
   import { useQueryClient } from '@tanstack/svelte-query';
 
   const id = $derived(page.params.id ?? '');

web/src/routes/albums/[id]/album.test.ts

@@ -3,7 +3,7 @@ import { render, screen } from '@testing-library/svelte';
 import { flushSync } from 'svelte';
 import { mockQuery } from '../../../test-utils/query';
 import { emptyLikesMock } from '../../../test-utils/mocks/likes';
-import type { AlbumDetail, TrackRef } from '$lib/api/types';
+import type { AlbumDetail, TrackRef } from '#lib/api/types.js';
 import { makeTrack } from '$test-utils/fixtures/track';
 
 const state = vi.hoisted(() => ({ pageParams: { id: 'xyz' } as Record<string, string> }));
@@ -15,15 +15,15 @@ vi.mock('$app/state', () => ({
   }
 }));
 
-vi.mock('$lib/api/queries', () => ({
+vi.mock('#lib/api/queries.js', () => ({
   qk: { album: (id: string) => ['album', id] },
   createAlbumQuery: vi.fn()
 }));
 
-vi.mock('$lib/api/likes', () => emptyLikesMock());
+vi.mock('#lib/api/likes.js', () => emptyLikesMock());
 
 import AlbumPage from './+page.svelte';
-import { createAlbumQuery } from '$lib/api/queries';
+import { createAlbumQuery } from '#lib/api/queries.js';
 
 function track(id: string, title: string, number: number, dur: number): TrackRef {
   return makeTrack({