bump stitch-wasm to 0.2.2, add config tests, update all dependencies

[fabracht]

Adopts @laboverwire/stitch-wasm 0.2.2, which implements config-override fields that 0.2.1 declared but did not honor. Our StoreConfig already exposed all of these (added during the 0.5.0 work, ahead of the wasm), so no type or doc changes were needed — the fields flip from "declared but inert" to functional. Adds integration coverage against the real 0.2.2 wasm.

Changes

• @laboverwire/stitch-wasm ^0.2.1 → ^0.2.2 (package.json + lockfile).
• Lockfile also carries three dev-only transitive bumps from npm audit fix (brace-expansion, postcss, sync) — installing 0.2.2 regenerated the lockfile and surfaced newly-published advisories; cleared back to 0.
• New tests/integration/wasm-config-fields.test.ts (3 tests).

What the tests actually verify

• localOnlyEntities — full CRUD (create/read/list/update/delete) on a local-only entity, readable without a replaceScope. Behaviorally verified.
• topLevelEntities — create/read/list on a globally-synced entity. Behaviorally verified.
• versionField / updatedAtField / userScopeField / syncTopicPrefix / responseTopicPrefix — these govern sync & offline-queue semantics that are not observable without a live MQTT broker. The test verifies only that 0.2.2 accepts the full extended config and core scoped CRUD is unaffected (config round-trips via store.config, create/update/version-increment work). Their actual sync semantics remain covered by stitch-rs's own tests, not here.

Verification

• tsc, eslint, prettier --check clean.
• 33 tests pass (10 files; +3) against real 0.2.2 wasm in Chromium.
• npm audit (full and --omit=dev) = 0.
• No API signature change in 0.2.2 (.d.ts diff is docs-only; the work is a +11.5 KB binary implementation behind the existing any config surface). No runtime API change in this package.

---

Second commit: update all dev & example dependencies to latest

Bumps every outdated dependency across the main repo and all three examples to latest, including majors where the toolchain supports them.

• main (devDeps): eslint 10.8, typescript-eslint 8.66, playwright 1.62 (+ new Chromium), prettier 3.9.6, react/react-dom 19.2.8, vue 3.5.41, rollup, globals, @types/react.
• examples: vite 7 → 8, @types/node 25 → 26, @vitejs/plugin-react 5 → 6, TypeScript 5.9 → 6.0.3, vue-tsc 3.3.9, @vitejs/plugin-vue 6.0.8.

TypeScript held at 6.0.3 (all trees)

TypeScript 7 was evaluated and deliberately not adopted: typescript-eslint hard-throws on TS 7 ("does not support TS 7.0", tracking #10940) and vue-tsc needs the TS 6 lib/tsc. TS 7's official model is running the @typescript/typescript6 compat API side-by-side for exactly these tools — which works, but for a sub-second build it adds real fragility for no functional gain (lint & vue type-check still execute TS 6). Decision: stay on TS 6.0.3 (latest 6.x) uniformly; revisit when the toolchain ships TS 7 support.

Verification

• main: tsc, eslint, prettier --check clean, 33 tests pass, build emits all entry points.
• All three examples build on vite 8 + TS 6.
• npm audit = 0 across all four trees.