chore(deps): update dev dependencies and remove unused ones

[dopry]

Summary

Reviews and updates all outdated dependencies. All production dependencies were already current — every change here is a devDependency. npm audit is now clean (0 vulnerabilities, down from 5).

Major bumps

• vitest / @vitest/ui / @vitest/coverage-v8 3.2 → 4.1
• semantic-release 21 → 25, @semantic-release/changelog 6 → 7, @semantic-release/git 10 → 11 (release config verified to load)
• @types/supertest 6 → 7
• nanoid 3 → 6 (ESM-only is fine now; only customAlphabet is used)

Minor/patch bumps

@types/debug, @types/semver, eslint 10.7, prettier, tsx, typescript 5.9.3, typescript-eslint 8.65

Removed (unused)

• sinon — not imported anywhere; tests use vitest's built-in vi mocking
• @types/destroy — the destroy package is never imported

Deliberately held back

• TypeScript 7.0.2 (native compiler) — not yet supported by typescript-eslint; kept on 5.9.x, worth revisiting as its own migration.

Test changes for vitest 4

• test/unit/github.spec.ts: constructor mocks (Octokit, Webhooks) rewritten as class-based implementations — vitest 4 disallows mockReturnValue on mocks invoked with new
• test/unit/backend-complete.spec.ts: vi.fn() mocks given explicit call signatures — untyped vi.fn() no longer satisfies express's Response signatures

Security

npm audit fix cleared advisories in braces, lodash-es, micromatch, and picomatch; the lockfile was regenerated. The esbuild advisory resolved itself with the removal of tsup on next (#50), which this branch is rebased on.

Test plan

• npm run typecheck — clean
• npm run lint — clean
• npm run build — clean (tsc emit)
• npm test — 771/771 passing (with env.test.sh sourced)
• npm run format:check — clean
• npm audit — 0 vulnerabilities

🤖 Generated with Claude Code

https://claude.ai/code/session_018qeKKb7HKWWM9E9iTh4JGk

---

Generated by Claude Code

[Copilot]

Pull request overview

This PR updates and prunes devDependencies (no production dependency changes), regenerates the lockfile to clear npm audit, and adjusts a couple unit tests to accommodate Vitest 4’s stricter mocking/typing behavior.

Changes:

• Bump major dev tooling: Vitest 4.x, semantic-release 25.x, nanoid 6.x, plus assorted minor/patch updates.
• Remove unused devDependencies (sinon, @types/destroy).
• Update unit tests for Vitest 4 constructor-mocking and stricter vi.fn() typing.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 2 comments.

File	Description
test/unit/github.spec.ts	Updates Octokit/Webhooks constructor mocks for Vitest 4.
test/unit/backend-complete.spec.ts	Adds explicit Vitest mock call signatures to satisfy Express Response typing.
package.json	Updates/removes devDependencies only.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated no new comments.