[chore] deps majors: vite 8 + vps 7 (rolldown), invert-color removed, flowbite 4 frozen

[AlexZ005]

Folds the open Dependabot PRs into one reviewed branch (riskiest last), off release/next.

What landed

1. vite 8.2 + @sveltejs/vite-plugin-svelte 7.2 (#90 + #91, coupled peers)

• vite 8 replaces rollup + esbuild with rolldown (build time ~12.6s).
• Tailwind 4 had to move from @tailwindcss/postcss to the @tailwindcss/vite plugin: vite 8's internal postcss-import resolves @import 'tailwindcss' as a literal file before the postcss plugin can claim it (build-time ENOENT). postcss.config.js deleted; @tailwindcss/vite@4.3.3 pins the exact installed tailwindcss.
• Dev https via the repo certs/ + server.https verified working on vite 8.
• SSR/circular-import stability: 12 dev boots on :5184, all curl-verified (document 200, JS module transform, Svelte transform, compiled tailwind CSS including the @utility output). Production build green; output CSS carries tailwind + flowbite-plugin + ui.utilities markers.

2. invert-color (#73) — removed instead of bumped

• Declared in package.json but imported nowhere (repo-wide grep over src/tests/scripts/tools). Removing supersedes the 2.0 → 3.0 bump without carrying a dead dependency forward.

3. flowbite 4 (#89) — NOT folded, frozen instead

• flowbite 4 is a full plugin-CSS redesign (50% fewer classes, dark-mode variants moved to CSS variables, all components refactored). flowbite-svelte 1.33 depends on flowbite ^3.1.2 (regular dep, not peer) and emits v3-era markup — bumping the root copy would style every flowbite-svelte component with v4 CSS and nest a second flowbite@3 under flowbite-svelte.
• The compatible pairing is flowbite-svelte 2.x (deps flowbite ^4.0.1), currently prerelease (2.0.0-next.14). Added to the dependabot.yml major-ignore + the deps-check FROZEN list; migrate both together when 2.0 goes stable.

4. npm audit fix

• nanoid high (GHSA-2v37-7h3g-55p8) fixed in-range. Remaining 3 lows are cookie <0.7 pinned inside the latest @sveltejs/kit 2.70.2 itself — static-adapter SPA, no server cookie path; accepted until kit bumps its pin.

Verification

• svelte-check: pristine baseline 419 / 62 re-measured before any bump, and 419 / 62 after — no drift, release.yml gate unchanged.
• npm run build green (rolldown).
• Full e2e sweep (261 suites, 1h48m) against the vite-8 dev server on :5184: 36 failed in the saturated full run. 24 were already on the known pre-existing/flaky list; the other 12 were solo-retested — 2 passed (saturation flakes), and the remaining 10 (agent-bridge, collider-live, dock-inset, explorer-files, roadmap-13-ui-polish, search-menus, sidebar-toggle, themes, ui-fixes-15lmno, window-chrome) were A/B-verified pre-existing: the identical suites fail with the identical FAIL lines (including the same wrong oklch(0.278 0.033 256.848) surface color in themes/window-chrome) on a pristine origin/release/next (aecaeb6) checkout with vite 7 + the postcss route in the same environment. Zero e2e regressions from this branch. The 10 deterministic base failures deserve their own investigation ticket — the known-failures list in the docs is stale.
• origin/release/next moved mid-run (PR [fix] 15-D mesh-edit correctness & input (weld/indexed, outside-click, hotkeys, contrast wire) #93 mesh lane) — merged into this branch; PR [fix] 15-D mesh-edit correctness & input (weld/indexed, outside-click, hotkeys, contrast wire) #93's three new mesh suites pass under vite 8 (3/3), svelte-check still 419/62 after the merge.

🤖 Generated with Claude Code