chore(deps): SvelteKit 3 with adapter-static 4 and TypeScript 6, full-tree npm audit (#5021)

Merges Renovate's kit 3 (PR #149) and adapter-static 4 (PR #148) bumps,
plus the migration they need. The mechanical part is `sv migrate
sveltekit-3`, run one task at a time and reviewed:

- svelte.config.js is gone. Its options move into sveltekit() in
  vite.config.ts, exported as kitOptions so vitest.config.ts runs the
  same kit setup, including the $test-utils alias the tests import.
- $lib becomes #lib through package.json "imports". There is no
  src/lib/index, so only the "#lib/*" entry is kept.
- tsconfig extends $app/tsconfig.
- Peer floors raised to kit 3's requirements: svelte ^5.57.1, vite
  ^8.0.12, svelte-check ^4.7.5.

By hand, from the codemod's list of non-automated tasks:

- goto's replaceState option is now replace; keepFocus becomes
  reset: false. For the search typeahead, reset: false also stops the
  scroll-to-top, which is wanted while typing.
- The test setup mocks drop pushState/replaceState and $app/paths
  base/assets, which kit 3 removed, and mock refreshAll in place of
  invalidateAll.
- The other flagged files only read page.url or goto internal routes,
  so they needed no change.

TypeScript goes to ^6, not the ^7 Renovate offers: kit 3 declares
typescript ^6 as a peer and svelte-check 4.7 accepts ^5 || ^6. Move to
7 once both accept it.

With Tailwind 4 and kit 3 in, `npm audit` on the whole tree reports 0,
so the web lane now audits every dependency rather than only what
ships to browsers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/src/routes/reset-password/[token]/+page.svelte

@@ -1,10 +1,10 @@
 <script lang="ts">
   import { goto } from '$app/navigation';
   import { page } from '$app/state';
-  import { pageTitle } from '$lib/branding';
-  import { resetPassword } from '$lib/auth/store.svelte';
-  import { errCode } from '$lib/api/errors';
-  import { rateLimitMessage } from '$lib/api/client';
+  import { pageTitle } from '#lib/branding.js';
+  import { resetPassword } from '#lib/auth/store.svelte.js';
+  import { errCode } from '#lib/api/errors.js';
+  import { rateLimitMessage } from '#lib/api/client.js';
 
   let newPassword = $state('');
   let confirmPassword = $state('');
@@ -27,7 +27,7 @@
     submitting = true;
     try {
       await resetPassword(token, newPassword);
-      await goto('/login?reset=ok', { replaceState: true });
+      await goto('/login?reset=ok', { replace: true });
     } catch (e: unknown) {
       const code = errCode(e);
       const throttled = rateLimitMessage(e);

web/src/routes/reset-password/[token]/reset-password.test.ts

@@ -1,7 +1,7 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 import { render, fireEvent, screen, waitFor } from '@testing-library/svelte';
 
-vi.mock('$lib/auth/store.svelte', () => ({
+vi.mock('#lib/auth/store.svelte.js', () => ({
   resetPassword: vi.fn(),
 }));
 
@@ -13,7 +13,7 @@ vi.mock('$app/state', () => ({
   page: { params: { token: 'test-token-abc' } },
 }));
 
-import { resetPassword } from '$lib/auth/store.svelte';
+import { resetPassword } from '#lib/auth/store.svelte.js';
 import { goto } from '$app/navigation';
 import ResetPasswordPage from './+page.svelte';
 
@@ -36,7 +36,7 @@ describe('/reset-password/[token] page', () => {
     await fireEvent.input(screen.getByLabelText('Confirm new password'), { target: { value: 'abcd1234' } });
     await fireEvent.click(screen.getByRole('button', { name: 'Set password' }));
     expect(resetPassword).toHaveBeenCalledWith('test-token-abc', 'abcd1234');
-    await waitFor(() => expect(goto).toHaveBeenCalledWith('/login?reset=ok', expect.objectContaining({ replaceState: true })));
+    await waitFor(() => expect(goto).toHaveBeenCalledWith('/login?reset=ok', expect.objectContaining({ replace: true })));
   });
 
   it('shows clear error on invalid_token', async () => {