chore: update dependencies (#43)

* chore: update dependencies

Closes #42

pg-sveltekit:
- npm audit fix clears devalue GHSA-77vg-94rm-hx3p (high) and the four
  svelte SSR/DOM/ReDoS advisories (moderate) by lifting devalue and
  svelte past the patched versions.
- Minor/patch: @e4a/pg-js 1.6.2 -> 1.8.0, @sveltejs/kit 2.59.1 -> 2.60.1,
  @types/node 25.7.0 -> 25.9.1, eslint 10.3.0 -> 10.4.0, svelte declared
  range -> ^5.55.8, typescript-eslint 8.59.3 -> 8.59.4.
- cookie override stays: @sveltejs/kit 2.60.1 still pins cookie ^0.6.0.

pg-manual:
- Patch: @e4a/pg-wasm 0.6.0 -> 0.6.1, web-streams-polyfill 4.2.0 -> 4.3.0.
- Major: @privacybydesign/yivi-{client,core,css,popup} 0.2 -> 1.x.
  v1 ships proper ESM with named exports, so examples/utils.js switches
  to `import { YiviCore } from ...` (etc). yivi.use(...) contract is
  unchanged; yivi-css stays a side-effect import.

vite 7 -> 8 / vite-plugin-svelte 6 -> 7 held back: vite-plugin-top-level-await
still `require('rollup')` at load and vite 8 dropped bundled rollup.

* chore(pg-sveltekit): vite 7 -> 8, vite-plugin-svelte 6 -> 7

Drops vite-plugin-top-level-await: it required `rollup` at module load
and vite 8 swaps rollup for rolldown, so the plugin is unloadable there.
With `build.target: 'esnext'`, vite 8 / rolldown passes top-level await
through unchanged for modern browsers (Chrome 89+, Firefox 89+, Safari 15+),
which the wasm plugin's init relies on. Concurrent TLA imports become
sequential after bundling (rolldown semantics), so init may be marginally
slower but still correct.

- vite 7.3.2 -> 8.0.13
- @sveltejs/vite-plugin-svelte 6.2.4 -> 7.1.2
- remove vite-plugin-top-level-await

---------

Co-authored-by: dobby-yivi-agent[bot] <275734547+dobby-yivi-agent[bot]@users.noreply.github.com>
Co-authored-by: Ruben Hensen <ruben.hensen@protonmail.com>

Author: dobby-coder[bot]

pg-manual/examples/utils.js

@@ -1,6 +1,6 @@
-import * as YiviCore from '@privacybydesign/yivi-core'
-import * as YiviClient from '@privacybydesign/yivi-client'
-import * as YiviPopup from '@privacybydesign/yivi-popup'
+import { YiviCore } from '@privacybydesign/yivi-core'
+import { YiviClient } from '@privacybydesign/yivi-client'
+import { YiviPopup } from '@privacybydesign/yivi-popup'
 import '@privacybydesign/yivi-css'
 
 export const KeySorts = {

pg-manual/package-lock.json

@@ -6,10 +6,10 @@
     "url": "https://github.com/encryption4all/postguard-examples.git"
   },
   "devDependencies": {
-    "@privacybydesign/yivi-client": "^0.2.1",
-    "@privacybydesign/yivi-core": "^0.2.1",
-    "@privacybydesign/yivi-css": "^0.2.1",
-    "@privacybydesign/yivi-popup": "^0.2.1",
+    "@privacybydesign/yivi-client": "^1.0.0",
+    "@privacybydesign/yivi-core": "^1.0.0",
+    "@privacybydesign/yivi-css": "^1.0.1",
+    "@privacybydesign/yivi-popup": "^1.0.1",
     "clean-webpack-plugin": "^4.0.0",
     "css-loader": "^7.1.4",
     "html-webpack-plugin": "^5.6.7",
@@ -19,13 +19,13 @@
     "streamsaver": "^2.0.6",
     "style-loader": "^4.0.0",
     "url": "^0.11.4",
-    "web-streams-polyfill": "^4.2.0",
+    "web-streams-polyfill": "^4.3.0",
     "webpack": "^5.106.2",
     "webpack-cli": "^7.0.2",
     "webpack-dev-server": "^5.2.4"
   },
   "dependencies": {
-    "@e4a/pg-wasm": "^0.6.0",
+    "@e4a/pg-wasm": "^0.6.1",
     "buffer": "^6.0.3",
     "util": "^0.12.5"
   },