@rollup/plugin-commonjs 25 → 28 and @rollup/plugin-node-resolve 15 → 16.

Default behavior changes (strictRequires=true, NODE_ENV export conditions)
are fine for this codebase — only svelte is bundled through these plugins
and it doesn't rely on CJS wrap semantics.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

electron 28 → 38 and electron-builder 24 → 26. No API surface used
(ipcMain.handle, contextBridge, BrowserWindow, shell.openExternal, Menu)
has breaking changes in this range.

Dropped electron-is-dev entirely — the only reference was a commented-out
devtools toggle. Swapped the comment to !app.isPackaged so re-enabling
doesn't need the dep. Avoids the v3 ESM/CJS interop issue.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Ran the official @tailwindcss/upgrade tool:
- tailwindcss 3.4 → 4.2
- @tailwind directives → @import 'tailwindcss'
- theme colors, animations, and keyframes moved to @theme block in CSS
- tailwind.config.js removed (config now CSS-first)
- postcss plugin replaced with @tailwindcss/postcss
- autoprefixer dropped (v4 handles vendor prefixing via Lightning CSS)
- utility renames applied by the tool (shadow-sm → shadow-xs,
  outline-none → outline-hidden)

Tailwind v4 split the CLI into @tailwindcss/cli; added it so the existing
build:css script continues to resolve the tailwindcss binary.

Dark mode config preserved via @custom-variant (class-based, as before).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

svelte 4 → 5, svelte-check 3 → 4, svelte-preprocess 5 → 6.

The 4 component files build and run cleanly in Svelte 5's legacy mode,
so the migration tool's runes conversion was not forced — per Svelte's
guidance, legacy Svelte 4 code continues to work in v5.

Fixed one svelte-check error surfaced by the newer type definitions:
currentTarget.style access in ResourceCard.svelte needed an
HTMLImageElement cast. The error predated this bump but was hidden
because svelte-check wasn't in the build script.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- @rollup/plugin-terser 0.4 → 1.0 to drop vulnerable serialize-javascript
- npm audit fix resolved transitive svgo and yaml advisories
- electron 38 → 41 closes the last high-severity advisory (offscreen
  paint UAF and related). No impact on our API surface — verified with
  a build, launch, and full electron-builder dist pass (dmg + zip).
- README Node minimum bumped v14 → v20 (electron-builder and Node 22
  baseline in the ecosystem make v14 non-viable).

npm audit now reports zero vulnerabilities.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Svelte 5 removed the new Component({ target }) instantiation API; the
compat shim doesn't cover bare new App() without going through
svelte/legacy's createClassComponent. Switching the entry to the
supported mount() from 'svelte' fixes an effect_orphan runtime error
that left the window blank.

Caught via devtools after the Phase 5 migration. The build, svelte-check,
and Electron launch all succeeded — only the renderer-initialization
path threw.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>