chore(deps): SvelteKit 3 with adapter-static 4 and TypeScript 6, full-tree npm audit (#5021)

Merges Renovate's kit 3 (PR #149) and adapter-static 4 (PR #148) bumps,
plus the migration they need. The mechanical part is `sv migrate
sveltekit-3`, run one task at a time and reviewed:

- svelte.config.js is gone. Its options move into sveltekit() in
  vite.config.ts, exported as kitOptions so vitest.config.ts runs the
  same kit setup, including the $test-utils alias the tests import.
- $lib becomes #lib through package.json "imports". There is no
  src/lib/index, so only the "#lib/*" entry is kept.
- tsconfig extends $app/tsconfig.
- Peer floors raised to kit 3's requirements: svelte ^5.57.1, vite
  ^8.0.12, svelte-check ^4.7.5.

By hand, from the codemod's list of non-automated tasks:

- goto's replaceState option is now replace; keepFocus becomes
  reset: false. For the search typeahead, reset: false also stops the
  scroll-to-top, which is wanted while typing.
- The test setup mocks drop pushState/replaceState and $app/paths
  base/assets, which kit 3 removed, and mock refreshAll in place of
  invalidateAll.
- The other flagged files only read page.url or goto internal routes,
  so they needed no change.

TypeScript goes to ^6, not the ^7 Renovate offers: kit 3 declares
typescript ^6 as a peer and svelte-check 4.7 accepts ^5 || ^6. Move to
7 once both accept it.

With Tailwind 4 and kit 3 in, `npm audit` on the whole tree reports 0,
so the web lane now audits every dependency rather than only what
ships to browsers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/src/test-utils/fixtures/track.ts

@@ -1,7 +1,7 @@
 // Fixture builders for TrackRef. Use in test setup to avoid
 // re-declaring the same literal across 18+ files.
 
-import type { TrackRef } from '$lib/api/types';
+import type { TrackRef } from '#lib/api/types.js';
 
 export function makeTrack(overrides: Partial<TrackRef> = {}): TrackRef {
   return {

web/src/test-utils/mocks/client.ts

@@ -1,9 +1,9 @@
-// Default api-client mock for $lib/api/client. Provides spies for
+// Default api-client mock for #lib/api/client. Provides spies for
 // every HTTP verb so tests don't need to anticipate which methods
 // the code under test might reach for.
 //
 // Usage:
-//   vi.mock('$lib/api/client', () => apiClientMock());
+//   vi.mock('#lib/api/client.js', () => apiClientMock());
 //
 // Tests that need a specific resolved value (e.g. events tests that
 // assert on the play_event_id round trip) keep custom mocks inline.

web/src/test-utils/mocks/likes.ts

@@ -1,9 +1,9 @@
-// Default empty-LikedIds mock for $lib/api/likes. Mirrors the
+// Default empty-LikedIds mock for #lib/api/likes. Mirrors the
 // TanStack Query readable shape (data + isPending + isError) that
 // 19 test files were duplicating verbatim.
 //
 // Usage:
-//   vi.mock('$lib/api/likes', () => emptyLikesMock());
+//   vi.mock('#lib/api/likes.js', () => emptyLikesMock());
 //
 // Tests that assert on liked-state changes (LikeButton.test.ts) keep
 // their state-driven mocks inline.

web/src/test-utils/mocks/playlists.ts

@@ -1,9 +1,9 @@
-// Default empty-playlists mock for $lib/api/playlists. The
+// Default empty-playlists mock for #lib/api/playlists. The
 // dominant shape across the menu / card tests: no playlists for
 // the user, append/create as resolved spies.
 //
 // Usage:
-//   vi.mock('$lib/api/playlists', () => emptyPlaylistsMock());
+//   vi.mock('#lib/api/playlists.js', () => emptyPlaylistsMock());
 //
 // Tests that exercise richer return payloads (AddToPlaylistMenu's
 // full PlaylistDetail return, PlaylistCard's getPlaylist, route

web/src/test-utils/mocks/quarantine.ts

@@ -1,8 +1,8 @@
-// Default empty-quarantine mock for $lib/api/quarantine. The
+// Default empty-quarantine mock for #lib/api/quarantine. The
 // dominant shape across 9 test files: empty list + spy mutations.
 //
 // Usage:
-//   vi.mock('$lib/api/quarantine', () => emptyQuarantineMock());
+//   vi.mock('#lib/api/quarantine.js', () => emptyQuarantineMock());
 //
 // Tests that assert on per-row state (FlagPopover, playlist tests)
 // keep custom mocks inline.

web/src/test-utils/query.ts

@@ -1,5 +1,5 @@
 import { readable } from 'svelte/store';
-import type { Page } from '$lib/api/types';
+import type { Page } from '#lib/api/types.js';
 
 // Synthetic infinite-query object shape matching what the SPA reads from
 // @tanstack/svelte-query. Enough surface area for component tests;