chore(deps): SvelteKit 3 with adapter-static 4 and TypeScript 6, full-tree npm audit (#5021)

Merges Renovate's kit 3 (PR #149) and adapter-static 4 (PR #148) bumps,
plus the migration they need. The mechanical part is `sv migrate
sveltekit-3`, run one task at a time and reviewed:

- svelte.config.js is gone. Its options move into sveltekit() in
  vite.config.ts, exported as kitOptions so vitest.config.ts runs the
  same kit setup, including the $test-utils alias the tests import.
- $lib becomes #lib through package.json "imports". There is no
  src/lib/index, so only the "#lib/*" entry is kept.
- tsconfig extends $app/tsconfig.
- Peer floors raised to kit 3's requirements: svelte ^5.57.1, vite
  ^8.0.12, svelte-check ^4.7.5.

By hand, from the codemod's list of non-automated tasks:

- goto's replaceState option is now replace; keepFocus becomes
  reset: false. For the search typeahead, reset: false also stops the
  scroll-to-top, which is wanted while typing.
- The test setup mocks drop pushState/replaceState and $app/paths
  base/assets, which kit 3 removed, and mock refreshAll in place of
  invalidateAll.
- The other flagged files only read page.url or goto internal routes,
  so they needed no change.

TypeScript goes to ^6, not the ^7 Renovate offers: kit 3 declares
typescript ^6 as a peer and svelte-check 4.7 accepts ^5 || ^6. Move to
7 once both accept it.

With Tailwind 4 and kit 3 in, `npm audit` on the whole tree reports 0,
so the web lane now audits every dependency rather than only what
ships to browsers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/src/routes/settings/Appearance.test.ts

@@ -1,7 +1,7 @@
 import { describe, expect, test, vi, beforeEach } from 'vitest';
 import { render, screen, fireEvent } from '@testing-library/svelte';
 
-vi.mock('$lib/api/listenbrainz', () => {
+vi.mock('#lib/api/listenbrainz.js', () => {
   // Mocks must look like a Svelte readable store. The page reads e.g.
   // $status.isPending, which is shorthand for "subscribe to status,
   // then read .isPending on the emitted value." Returning an object
@@ -27,8 +27,8 @@ vi.mock('$lib/api/listenbrainz', () => {
 
 // The Notifications section has its own tests (NotificationSettings.test.ts);
 // here it only needs a settled query so the page renders.
-vi.mock('$lib/api/notifications', async (importOriginal) => {
-  const mod = await importOriginal<typeof import('$lib/api/notifications')>();
+vi.mock('#lib/api/notifications.js', async (importOriginal) => {
+  const mod = await importOriginal<typeof import('#lib/api/notifications.js')>();
   const { mockQuery } = await import('../../test-utils/query');
   return {
     ...mod,
@@ -39,8 +39,8 @@ vi.mock('$lib/api/notifications', async (importOriginal) => {
 });
 
 // The Volume leveling setting loads on mount; keep it off the network.
-vi.mock('$lib/api/normalization', async (importOriginal) => {
-  const mod = await importOriginal<typeof import('$lib/api/normalization')>();
+vi.mock('#lib/api/normalization.js', async (importOriginal) => {
+  const mod = await importOriginal<typeof import('#lib/api/normalization.js')>();
   return {
     ...mod,
     getNormalization: vi.fn().mockResolvedValue(mod.DEFAULT_NORMALIZATION),
@@ -48,7 +48,7 @@ vi.mock('$lib/api/normalization', async (importOriginal) => {
   };
 });
 
-vi.mock('$lib/api/metrics', () => ({
+vi.mock('#lib/api/metrics.js', () => ({
   createRecommendationMetricsQuery: () => ({
     subscribe: (run: (v: unknown) => void) => {
       run({ isPending: false, isError: false, data: { window_days: 30, baseline: null, groups: [] } });