Update dependencies and verify restore behaviour

[vrtmrz]

This dependency update refreshes the build and runtime packages and prevents restoration from hanging on malformed ZIP64 input.

Changes

• Update 35 direct dependencies, including fflate 0.8.3, ESLint 10, Vitest 5, and jsdom 30, and regenerate the lockfile with npm 10.9.4.
• Use TypeScript 6.0.3 to remain within the supported peer dependency ranges of the current typescript-eslint and Svelte tools.
• Add a regression test that runs DiffZip's archive extraction in a worker: valid ZIP input succeeds, and a ZIP64 entry without its required extra field is rejected. The test for malformed input first reproduced the hang with fflate 0.8.2 and passes with 0.8.3.
• Update three mirror restore E2E expectations to match the existing destructive confirmation title and action label.

Validation

Validated on Linux ARM64 with Node.js 24.18.0, npm 10.9.4, and Deno 2.9.2:

• Build, normal lint, Community review blocker checks, and Obsidian E2E typechecking passed.
• UI tests: 17 passed, including the ZIP64 regression tests.
• Deno tests: 67 test bodies passed, including ZIP extraction and encrypted archive compatibility with unzip, 7-Zip, and OpenSSL. The Windows-only PowerShell test was skipped.
• Release metadata test: 1 passed.
• Real Obsidian 1.12.7 E2E: restore confirmation, legacy folder restoration, mirror deletion semantics, and operation wake-lock lifecycle all passed in temporary vaults.
• npm audit --package-lock-only: zero vulnerabilities, down from nine affected packages.
• npm 10 dependency-tree validation and git diff --check passed.

The build and lint checks still report warnings about the initial Svelte state and settings-search integration. Real iOS, Android, and Windows environments were not tested.