chore(deps): SvelteKit 3 with adapter-static 4 and TypeScript 6, full-tree npm audit (#5021)

Merges Renovate's kit 3 (PR #149) and adapter-static 4 (PR #148) bumps,
plus the migration they need. The mechanical part is `sv migrate
sveltekit-3`, run one task at a time and reviewed:

- svelte.config.js is gone. Its options move into sveltekit() in
  vite.config.ts, exported as kitOptions so vitest.config.ts runs the
  same kit setup, including the $test-utils alias the tests import.
- $lib becomes #lib through package.json "imports". There is no
  src/lib/index, so only the "#lib/*" entry is kept.
- tsconfig extends $app/tsconfig.
- Peer floors raised to kit 3's requirements: svelte ^5.57.1, vite
  ^8.0.12, svelte-check ^4.7.5.

By hand, from the codemod's list of non-automated tasks:

- goto's replaceState option is now replace; keepFocus becomes
  reset: false. For the search typeahead, reset: false also stops the
  scroll-to-top, which is wanted while typing.
- The test setup mocks drop pushState/replaceState and $app/paths
  base/assets, which kit 3 removed, and mock refreshAll in place of
  invalidateAll.
- The other flagged files only read page.url or goto internal routes,
  so they needed no change.

TypeScript goes to ^6, not the ^7 Renovate offers: kit 3 declares
typescript ^6 as a peer and svelte-check 4.7 accepts ^5 || ^6. Move to
7 once both accept it.

With Tailwind 4 and kit 3 in, `npm audit` on the whole tree reports 0,
so the web lane now audits every dependency rather than only what
ships to browsers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/vite.config.ts

@@ -1,3 +1,5 @@
+import adapter from '@sveltejs/adapter-static';
+import { vitePreprocess } from '@sveltejs/vite-plugin-svelte';
 import { sveltekit } from '@sveltejs/kit/vite';
 import { defineConfig } from 'vite';
 import { execSync } from 'node:child_process';
@@ -53,8 +55,28 @@ const injectGoTokensPlugin = {
   }
 };
 
+// SvelteKit's options, which lived in svelte.config.js before kit 3. Exported
+// so vitest.config.ts runs the same kit setup (the $test-utils alias above all).
+export const kitOptions = {
+  preprocess: vitePreprocess(),
+  adapter: adapter({
+    pages: 'build',
+    assets: 'build',
+    fallback: 'index.html',
+    precompress: false,
+    strict: false
+  }),
+  files: { assets: 'static' },
+  alias: {
+    // test-only helper barrel; resolves the same way #lib does so test
+    // files can import shared mock factories without ../../../ chains.
+    '$test-utils': 'src/test-utils',
+    '$test-utils/*': 'src/test-utils/*'
+  }
+};
+
 export default defineConfig({
-  plugins: [tokensPlugin, sveltekit(), injectGoTokensPlugin],
+  plugins: [tokensPlugin, sveltekit(kitOptions), injectGoTokensPlugin],
   server: {
     port: 5173,
     proxy: {