chore(deps): migrate to eslint 10, resolve 6 high-severity vulns

[cdevos-purse]

Summary

Resolves all 6 high-severity advisories reported by npm audit, all of which were transitive devDependencies. Bumping eslint to 10 was the entry point, and it also let us drop five dependencies that turned out to be dead.

npm audit goes from 6 high to 0. The lockfile loses 253 packages.

Vulnerabilities fixed

Advisory package	Fixed by
js-yaml	eslint 9 → 10
postcss, nanoid	vite 8.0.16 → 8.2.1
ws	jsdom 26 → 30
fast-uri	vite-plugin-dts 4.5.4 → 5.0.3

Dependency cleanup

eslint.config.mjs only ever referenced typescript-eslint, @eslint/js and globals. Everything else in the eslint dependency set was unused:

Removed	Why
@typescript-eslint/eslint-plugin, @typescript-eslint/parser	Superseded by the typescript-eslint umbrella package already in use
eslint-plugin-import	Unused, and its peer range caps at eslint 9 — would have blocked this upgrade outright
eslint-plugin-prettier (^3.1.1, five years stale)	Unused; formatting is enforced by the separate check-format script
eslint-config-prettier	Unused, same reason

Conversely, @eslint/js and globals were imported by the config but never declared, resolving transitively by luck. They are now explicit.

No changes to eslint.config.mjs were needed — the flat config is already eslint 10 compatible.

⚠️ Requires NODE_VERSION = 24

eslint 10 requires Node ^20.19.0 || ^22.13.0 || >=24. The NODE_VERSION repo variable consumed by on-pr-lint.yaml must be updated before this merges. on-push-tag-release.yaml already pins '24'.

⚠️ A pre-existing packaging bug, surfaced and suppressed

@arethetypeswrong/cli goes 0.15.3 → 0.18.5 because 0.15.3 crashes outright on Node 24 (Cannot read properties of undefined (reading 'filename')), meaning the check-exports CI step has not actually been verifying anything.

The working version immediately surfaces a real, pre-existing bug: main points at a UMD bundle whose exports are emitted as Object.defineProperty(e,"Dropin",…) calls, which cjs-module-lexer cannot statically detect. So this crashes at runtime for Node ESM consumers:

import { Dropin } from '@purse-eu/web-sdk';

It is suppressed here via --ignore-rules named-exports to keep this PR scoped to dependencies. Fixing it properly means renaming the ESM output to .mjs and adding an exports map — that changes published entry points for consumers, so it warrants its own PR.

Also spotted, deliberately not touched

• conditional-type-checks is unused — no IsExact / AssertTrue anywhere in the tree.
• tsc fails on missing final-form / zod types in src/generated/types/*.d.ts. Pre-existing, and CI runs no typecheck step.

Test plan

Verified on Node 24.15.0:

• npm run build — exit 0
• npm run lint — exit 0 (0 errors, 3 pre-existing warnings)
• npm run check-exports — exit 0
• npm test — 5 tests, 1 file, all passing
• npm audit — 0 vulnerabilities

Rebased onto v0.10.0

Main gained three commits while this was open, two touching the lockfile: c3969a3 (a parallel npm audit fix) and 269d526 (v0.10.0). Rebased rather than hand-merging the lockfile — package.json merged cleanly at 0.10.0, and package-lock.json was deleted and regenerated from scratch.

The dep bumps here supersede c3969a3 entirely; brace-expansion now resolves to 5.0.9 via eslint 10, well past that advisory. Re-verified on the new base: build, lint, check-exports and test all exit 0, npm audit reports 0 vulnerabilities.