chore(deps): upgrade all packages to latest + align shared versions - #4597

Aligns desktop's TypeScript with muya (already on 6). vue-tsc 2->3
(vue-language-tools 3); typescript-eslint 8.61 supports TS <6.1 and vue-tsc 3
peers TS >=5, so the desktop type-check stack moves cleanly.

Verified: `vue-tsc --noEmit` passes on desktop. TypeScript is type-check-only
tooling here (esbuild drives build + vitest), so runtime/build are unaffected.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Bumps the math renderer to 0.17 and normalizes muya's pin from an exact
`0.16.47` to `^0.17.0`, so the declared version is consistent across the three
packages. mermaid + micromark-extension-math keep their own transitive
katex 0.16.x (forcing those to 0.17 risks their math rendering).

Verified: muya 143 unit + 4 conformance, desktop 17 unit, build:unpack OK.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

plist is used in a single place: parsing the macOS NSFilenamesPboardType
clipboard payload via `plist.parse()` (main/ipc/shell.ts). The parse API is
stable across the major bump — desktop type-check passes against plist 5's
types and build:unpack is clean. Transitive plist 3.x pulled by other tooling
is left as-is.

Verified: desktop typecheck clean, build:unpack OK.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Desktop's router uses only modern APIs (createRouter + createWebHashHistory,
RouteRecordRaw, named/children/redirect routes, <router-view>) — none of the
deprecated APIs v5 removes. v5's only required peer is vue ^3.5.34 (satisfied);
pinia / @pinia/colada / vite peers are optional.

Verified: desktop typecheck clean, 17 unit suites pass, build:unpack OK.
Real-app routing is additionally exercised by the e2e / run-on-pr-head CI jobs.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

marked 17+ changed tokenization in ways muya's parser layer must absorb:

- Task lists: marked now emits a `checkbox` token and keeps the literal
  "[ ] " / "[x] " marker in the item content (in a paragraph's `text` for
  loose lists). muya renders the marker from the task-list-item `checked`
  meta, so `compatibleTaskList` now strips it from both tight and loose items
  — otherwise every md -> state -> md round-trip duplicated the checkbox.
- Indented code: the `code` token text now carries a trailing newline (fenced
  does not); markdownToState strips it so indented blocks round-trip.
- Setext headings: conformance improved — CommonMark #84/#89 and GFM #54/#59
  now pass and are removed from expected-failures.json.

Verified: muya 143 unit + 4 conformance suites (compliance up), desktop 17
unit, build:unpack OK.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Re-checked every security override against the upgraded tree. The dependency
refresh now resolves patched versions natively, so 7 of the 8 overrides are
redundant and removed:

  @babel/core (7.29.6), form-data (4.0.6), js-yaml (4.2.0), tar (7.5.16),
  tmp (0.2.6), undici (7.28.0), ws (8.21.0)

Kept:
  - esbuild >=0.27.0 <0.28.1 -> 0.28.1: vite 7.3.5 (desktop, pinned by
    electron-vite which peers vite <=7) still pulls the vulnerable esbuild
    0.27.7; this bridges it until electron-vite supports vite 8.
  - postcss 8.5.15: pre-existing (since #4314), pins to current latest 8.x.

Verified: lockfile keeps every previously-flagged package at a patched
version; build:unpack OK.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

muya pinned mermaid to an exact "11.15.0" while desktop/muyajs use "^11.15.0".
Normalize to "^11.15.0" so the declared version is consistent across packages
(resolves to the same 11.15.0).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

vue-router 5 passed typecheck/unit/build but broke the desktop app launch in
e2e: every suite's beforeAll timed out because the renderer never reached
ready (renderer errors captured by the e2e helper). Unit tests don't mount the
full app + router, so the runtime regression only surfaced in e2e.

Revert to ^4.6.4 (latest 4.x, known-good). vue-router 5 needs a dedicated
migration PR with e2e verification, like codemirror 6 / website next 16.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

plist 5 ships ESM-only with named exports and no CJS `exports` entry, so the
externalized main-process `require('plist')` threw
ERR_PACKAGE_PATH_NOT_EXPORTED at startup — the app never launched, which failed
every desktop e2e suite (beforeAll launch timeout). The earlier vue-router
revert was a red herring; muya's own e2e passed, ruling out the engine.

Fix: exclude plist from externalization so electron-vite bundles it as CommonJS
(same pattern as electron-store), and switch shell.ts to a namespace import
(`import * as plist`) since plist 5 dropped its default export.

Verified: build:unpack bundles plist inline (no runtime require('plist')),
typecheck clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

…xvfb CI)

Root-caused the desktop e2e teardown cascade. app.close() hangs cumulatively
across the workers:1 sequential run on Linux/xvfb: each Electron app leaves
child processes that don't terminate promptly, accumulating until close — then
later launches — fail (~16 "Worker teardown timeout" + did-not-run). It does
NOT reproduce on macOS (113/114 local), and is not font-list / vue-router /
@playwright/test / electron-updater (each eliminated with evidence: e.g.
font-list 2.0.2 leaks the same handle; reverting playwright/vue-router didn't
help). The only changed process-runtime dependency is electron 42.1->42.4
(clean-CI #4596 ran 42.1.0). Pin to ~42.1.0; revisit 42.x once its
headless-Linux child-process teardown is stable.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Split the two "mounts the html_tag into the live editor DOM" cases (<u>/<mark>)
out of formatToggle.spec.ts into formatToggleHtmlTagMount.spec.ts (jsdom). They
route a live element through DOMPurify, which strips all elements under
happy-dom on dompurify 3.4.8+ (its namespace hardening isn't satisfied there).
The rest of formatToggle.spec.ts stays on happy-dom because its selection /
picker assertions rely on happy-dom's selection behavior. Consistent with the
other DOMPurify-dependent specs moved to jsdom in the dompurify bump.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>