Migrate to Svelte 5

[spe1020]

Follow-up from PR #373 and security direct-dependency bump work.

This migration is required to clear deferred advisories that are blocked on the current Svelte 4 toolchain:

• Svelte SSR advisories: GHSA-m56q-vw4c-c2cp, GHSA-f7gr-6p89-r883, GHSA-crpf-4hrx-3jrp, GHSA-phwv-c562-gvmh (8 dashboard alerts)
• Vite advisory fix: Mobile wallet performance improvements #48 / GHSA-4w7w-66w2-5vf9 (fixed on Vite 6+)
• esbuild advisory Add Tagging feature to kind 1 notes #34 / GHSA-67mh-4wv8-2f99 (resolved transitively once Vite 6+ lands)

Context: PR #373 intentionally stayed on Vite 5.4.21 because Vite 6 requires Svelte 5-compatible plugin/toolchain changes. The Svelte SSR code audit in that PR found no currently exploitable patterns in src/, but migration remains required to fully close these advisories.

Scope for this issue:

• plan and execute Svelte 4 -> 5 migration
• upgrade Vite/tooling to the patched line compatible with Svelte 5
• close the deferred advisories above