chore(deps): bump svelte and @sveltejs/kit to patch security advisories (#221)

- svelte 5.55.5 -> 5.55.7 (XSS via spread attrs, hydratable Promise, DOM
  clobbering, <svelte:element> ReDoS)
- @sveltejs/kit 2.59.1 -> 2.60.1 (pulls patched devalue 5.8.1 — DoS via
  sparse array deserialization)

`npm audit` reports 0 vulnerabilities after the bump.

Closes #220

Co-authored-by: dobby-yivi-agent[bot] <275734547+dobby-yivi-agent[bot]@users.noreply.github.com>

Author: dobby-coder[bot]

package-lock.json

@@ -17,7 +17,7 @@
         "@eslint/js": "^10.0.1",
         "@playwright/test": "^1.60.0",
         "@sveltejs/adapter-static": "^3.0.10",
-        "@sveltejs/kit": "^2.59.1",
+        "@sveltejs/kit": "^2.60.1",
         "@sveltejs/vite-plugin-svelte": "^7.1.2",
         "@types/node": "^25.7.0",
         "@typescript-eslint/eslint-plugin": "^8.59.3",
@@ -35,7 +35,7 @@
         "prettier-plugin-svelte": "^3.5.2",
         "rollup": "^4.60.3",
         "sass": "^1.99.0",
-        "svelte": "^5.55.5",
+        "svelte": "^5.55.7",
         "svelte-check": "^4.4.8",
         "svelte-i18n": "^4.0.1",
         "svelte-preprocess": "^6.0.3",