chore: update dependencies to latest compatible versions

[kboshold]

What

Moves every dependency to the newest version that still works, plus a lockfile refresh of transitives.

	from	to
c12	^3.2.0	^3.3.4
defu	^6.1.4	^6.1.7
@antfu/eslint-config	^9.2.0	^9.3.0
@types/semver	^7.7.1	^7.8.0
@typescript-eslint/parser	^8.65.0	^8.66.0
publint	^0.3.22	^0.3.23
typescript	^6.0.0	^6.0.3

Three things were deliberately left behind:

• typescript 7.0.2. I tried it: tsc --noEmit passes, but eslint crashes and unbuild fails inside rollup-plugin-dts, both because 7.0 shipped without the JS compiler API. This is the case the ignore rule in dependabot.yml already describes.
• c12 4.0.0-beta.5. That is where the npm latest tag points today, but it is a prerelease.
• @typescript-eslint/parser 8.67.0. Published less than 7 days ago, so the new minimum-release-age in .npmrc skipped it. It will land on its own.

Why

Nothing had been updated in a while. Doing it in one pass now means the weekly dependabot PR stays small.

Typecheck, lint, the 720 tests, and the build all pass on these versions.

One known audit finding

pnpm audit reports one high: nanoid <3.3.18 (GHSA-2v37-7h3g-55p8), reached through @antfu/eslint-config > eslint-processor-vue-blocks > @vue/compiler-sfc > postcss > nanoid.

Left as is on purpose. It is devDependencies only (pnpm why nanoid --prod is empty, and nanoid does not appear in dist/), so nothing reaches users. The patched 3.3.18 was published a couple of hours ago and postcss already allows it, so the only thing holding it back is our own 7 day cooldown. It will come in next week.