chore: upgrade wxt to 0.21, unblocking vite/svelte/vitest CVE fixes

[guidodinello]

Summary

• Bumps wxt 0.19.9 → 0.21.4 (moves vite from hard dependency to peer dependency, removing the structural blocker), vite → 8.2.2, svelte → 5.57.0 (first stable release), @sveltejs/vite-plugin-svelte → 7.3.0, vitest/@vitest/ui → 5.0.0, tailwindcss/@tailwindcss/vite → 4.3.3 (first stable release), svelte-check → 4.7.6, @wxt-dev/module-svelte → 2.0.5.
• Removes vite-plugin-wasm and vite-plugin-top-level-await from wxt.config.ts and package.json — verified via grep that this extension has no .wasm files or WebAssembly usage anywhere; they were unused boilerplate carried over from the starter template (confirmed empirically: they were the actual cause of a vite-8/vite-7 build failure during a pre-flight check, unrelated to the vite version itself).
• Removes the bare @sveltejs/vite-plugin-svelte: ^4.0.0-next override (present in overrides/resolutions/pnpm.overrides) that was pinning vpsvelte to 4.x underneath the devDependency bump. Swept all now-inert selector-scoped CVE overrides — pnpm audit is clean with no overrides needed at all post-upgrade (this repo's dependency graph resolves giget uniformly to a version with no tar dependency, unlike the sibling repos).
• Drops @types/chrome; adds @types/node.
• Migrates runner: → webExt: in wxt.config.ts.
• Fixes a real runtime break: src/entrypoints/background.ts's browser.runtime.onMessage listener was async and returned a Promise — WXT 0.20+ dropped the webextension-polyfill, which is what let promise-returning listeners work. Rewritten to the sendResponse(...) + return true pattern. Note: this APPLY_FILTERS message branch appears currently unreachable from any UI in this codebase (the popup only toggles filters directly via storage; the context menu sends APPLY_FILTERS_NOW straight to the content script, bypassing this handler) — so I can't currently exercise it end-to-end, but the API-contract bug was real regardless and is now fixed.
• Fixes real fallout from WXT 0.21's hardened generated tsconfig (noUncheckedIndexedAccess): src/lib/stores/filters.ts (derived the storage-listener type from browser.storage.onChanged.addListener's own signature instead of a hand-rolled one that no longer matched), src/lib/utils/validation.ts (safe destructuring default).
• Switched vitest.config.ts off the deprecated __dirname to import.meta.dirname.
• CI: bumps Node 20 → 24 (required by wxt/vitest 5's engines), fixes pnpm format → pnpm format:check (the former writes files and passes unconditionally — the CI format gate was a no-op), adds a pnpm test step (previously zero CI coverage for the critical vitest alert).
• Separate commits for config migration, the runtime-break fix, and the Tailwind 4 class-ordering reflow from prettier-plugin-tailwindcss 0.5→0.8, so the migration diff stays reviewable.

Alerts this closes

All open Dependabot alerts on vite, svelte, vitest (critical), esbuild, and extract-zip (high — the dependency disappears entirely with wxt 0.21's slimmer publish-browser-extension dependency) — superseding PRs #12, #13, #14.

Test plan

• pnpm install (scripts on) — postinstall wxt prepare succeeds
• pnpm run check — 0 errors (3 pre-existing, unrelated warnings)
• pnpm build and pnpm build:firefox — both succeed
• pnpm test — 38/38 passing
• pnpm lint — 0 errors (1 pre-existing, unrelated warning)
• pnpm audit — no known vulnerabilities
• Manual smoke test: load the built extension, open a GitHub PR page, verify the content-script UI renders correctly under Tailwind 4 stable, and verify filter toggling/editing works via the popup and options page (please verify before merging — I can't drive the actual GitHub UI from here)

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.