chore(deps): migrate to Svelte 5, Vite 8, and related ecosystem packages

[Kamirus]

Summary

Dependabot PRs #475, #480, and #482 all fail because @sveltejs/vite-plugin-svelte@7.0.0 requires svelte@^5.46.4 as a peer dependency, but the project uses svelte@4.2.12. There is no version of @sveltejs/vite-plugin-svelte that supports both Vite 8 and Svelte 4 — the migration must be done together.

This PR upgrades both frontend/ and cli-releases/frontend/ to Svelte 5 + Vite 8 in one shot. Svelte 5's compatibility mode preserves full Svelte 4 component syntax (export let, on:click, reactive $: blocks, etc.), so no .svelte file rewrites are needed.

Key changes

frontend/

• svelte 4.2.12 → 5.55.2, vite 5.2.6 → 8.0.8, @sveltejs/vite-plugin-svelte 3.0.2 → 7.0.0
• svelte-chartjs 3.1.5 → 4.0.1, vite-plugin-static-copy 1.0.2 → 4.0.1
• Drop svelte-preprocess in favor of vitePreprocess from @sveltejs/vite-plugin-svelte
• Pin @dfinity/candid@1.0.1 via overrides (pre-existing transitive peer conflict with @dfinity/agent@1.0.1 — without this, npm resolves candid@2.x which is ABI-incompatible)
• Enable compatibility.componentApi: 4 — the entry point and svelte-spa-history-router use new Component() which is invalid in Svelte 5 without this flag

cli-releases/frontend/

• svelte 4.2.12 → 5.55.2, vite 5.4.21 → 8.0.8, @sveltejs/vite-plugin-svelte 3.0.2 → 7.0.0
• @sveltejs/kit 2.55.0 → 2.57.1 (adds explicit Vite 8 support)
• No compatibility.componentApi needed — cli-releases components don't use export let

Both projects: svelte-check 3→4, eslint-plugin-svelte 2.35→2.46 (adds Svelte 5 peer support)

Additional fixes discovered during staging verification

• Svelte 5 CSS scoping: <style global> is deprecated — replaced with <style> and :global() wrappers in App.svelte to preserve global styles
• Vite 8 process.env polyfill: Added "process.env": "({})" fallback in vite.config.ts — Vite 8 no longer auto-polyfills process.env, causing ReferenceError on package detail pages
• MOPS_NETWORK staging fix: Changed Package.svelte to set MOPS_NETWORK to "ic" for all non-local deployments — previously the ic-mops npm package used hardcoded staging canister IDs when DFX_NETWORK=staging, causing "Package not found" errors
• fetchRootKey guard: Tightened declarations/main/index.js and declarations/bench/index.js to only call fetchRootKey() for DFX_NETWORK === "local" (was !== "ic", which unnecessarily triggered for staging)
• ConfigDoc.svelte cleanup: Added <thead>/<tbody> for semantic HTML, removed commented-out table rows
• import type fixes: Changed all .did.js type imports to use import type (required by Svelte 5's stricter TypeScript handling)

Security advisories addressed

• vite <=6.4.1 (esbuild vulnerability)
• vite-plugin-static-copy 0.4.3–2.3.1 (GHSA-pp7p-q8fx-2968, path traversal)

Supersedes

• chore(deps-dev): bump vite, @sveltejs/vite-plugin-svelte and vite-plugin-static-copy in /frontend #475 (closed)
• chore(deps-dev): bump vite and @sveltejs/vite-plugin-svelte in /cli-releases/frontend #480
• chore(deps-dev): bump vite, @sveltejs/vite-plugin-svelte and vite-plugin-static-copy in /frontend #482

Test plan

• CI passes: npm ci + ci:postinstall resolves without ERESOLVE errors (all 23 checks green)
• npm run lint passes
• Frontend builds successfully (npm run build-frontend)
• CLI releases frontend builds (npm run build-cli-releases)
• CLI tests pass (11 suites, 69 tests, 52 snapshots)
• Bundle smoke test passes (verified in CI)
• Frontend dev server loads with production canister — no runtime errors
• CLI releases frontend serves pre-built assets correctly
• Staging deploy verified: homepage (272 packages), package detail pages (/core, /vector), correct fonts/styles, no console errors