Fix DotLottie WASM 404 on project detail pages

[nighca]

Closes #3372

Summary

• declare @lottiefiles/dotlottie-web as a direct dependency
• preserve Vite's existing new URL(..., import.meta.url) handling for the emitted, hashed local asset

Root Cause

@lottiefiles/dotlottie-web was only a transitive dependency of @lottiefiles/dotlottie-vue. Before the pnpm migration, npm hoisting made the WASM package path available at the application level. pnpm does not provide that implicit hoisting, so Vite could not resolve the existing WASM URL during the build and left it for the browser to request as a missing /assets/@lottiefiles/... path.

Declaring the package directly makes the WASM path resolvable to Vite again. The existing new URL(..., import.meta.url) expression is then transformed to the generated, hashed local asset URL.

Verification

• pnpm run lint
• pnpm run build
• confirmed that the production output contains dist/assets/dotlottie-player-*.wasm and no unresolved DotLottie package path

[fennoai]

Review summary

The DotLottie fix itself (issue #3372) is minimal and correct: src/setup/index.ts resolves @lottiefiles/dotlottie-web/dist/dotlottie-player.wasm via new URL(..., import.meta.url), but the package was only present transitively. Promoting it to a direct dependency pinned at 0.41.0 (matching the version @lottiefiles/dotlottie-vue@0.5.8 resolves) is the right way to stop relying on a phantom transitive path and to fix the WASM 404.

Two points worth addressing before merge:

1. Scope — this PR bundles an unrelated feature. The title/body describe only the DotLottie fix (Closes #3372), but the diff against dev is two commits: the DotLottie fix and eaae2ed4 "feat(ispx): support setting username… (#3365)", which adds tools/ispx/username.go and the xbuilder_set_username injection in ProjectRunner.vue. That username commit is not on dev and would land with this PR. Mixing a separately-tracked feature into a bugfix PR makes review, changelog, and revert harder (reverting the DotLottie fix would also revert the username feature). Consider splitting so this PR carries only the @lottiefiles/dotlottie-web dependency change, unless bundling #3365 here is intentional.

2. Potential indefinite hang on the run path — see the inline comment on spx-gui/src/components/project/runner/ProjectRunner.vue.

No other blocking issues found. The Go side (tools/ispx/username.go) follows the existing ispx convention (//go:build js && wasm, init() + js.Global().Set, len(args) > 0 guard), and the xbuilder_set_username call is correctly placed after engine init (so the WASM global is registered).

Findings without inline locations

• spx-gui/src/components/project/runner/ProjectRunner.vue:352: untilNotNull(signedInStateQuery.data, ...) only resolves when .data becomes non-null; it does not reject on query error. In useQuery, an error sets only error.value and leaves data.value null (see spx-gui/src/utils/query.ts:85). So if the signed-in-user fetch fails (transient network error / 5xx / offline), this await never resolves and project startup blocks indefinitely at this step, right before startGame() — recoverable only via abort/unmount.

[fennoai]

Corrected review (supersedes my earlier note)

My previous comment on this PR was based on a stale local dev and is incorrect — please disregard its "scope" and ProjectRunner.vue findings. GitHub's authoritative base for this PR is commit eaae2ed4 (the #3365 username feature is already in the base), so the real diff is only two files — the @lottiefiles/dotlottie-web dependency addition. The username feature is not part of this PR. Apologies for the noise.

Assessment of the actual change

The fix is minimal and correct. src/setup/index.ts resolves @lottiefiles/dotlottie-web/dist/dotlottie-player.wasm via new URL(..., import.meta.url), but the package was previously only present transitively (via @lottiefiles/dotlottie-vue). Promoting it to a direct dependency lets Vite emit and hash the WASM asset, fixing the 404 (issue #3372).

• Version pin 0.41.0 (exact) — good. It matches the version @lottiefiles/dotlottie-vue@0.5.8 resolves to in the lockfile, avoiding a duplicated/mismatched dotlottie-web copy. pnpm-lock.yaml is updated consistently.

• Minor (non-blocking): spx-gui/package.json — the new @lottiefiles/dotlottie-web entry is inserted before @lottiefiles/dotlottie-vue, which breaks the file's alphabetical dependency ordering (-vue sorts before -web). No sort tooling enforces it, but the rest of the list is alphabetical; consider moving the entry just below @lottiefiles/dotlottie-vue for consistency.

No blocking issues. LGTM once the ordering nit is (optionally) addressed.