chore(deps): update npm and cargo dependencies

[owjs3901]

Updates every dependency the repository actually owns, and leaves the two things it deliberately pins alone.

What moved

plugin/ — absorbs Dependabot #51 and #52.

	from	to
@rspack/cli / @rspack/core	^1.2.0	^2.2.3
typescript	^5.8.0	^7.0.2
@figma/plugin-typings	^1.109.0	^1.138.0
html-webpack-plugin	^5.6.3	^5.6.8

harness/render/

	from	to
vite	^6.3.0	^8.3.0
@vitejs/plugin-react	^4.4.0	^6.1.1
typescript	^5.8.0	^7.0.2
@devup-ui/vite-plugin	^1.0.41	^1.0.69
react / react-dom / types	^19.1.0	^19.3.0
playwright	^1.54.0	^1.63.0

Cargo — 35 packages to their latest 1.98-compatible versions.

The risk I checked before touching harness/render

That directory is not ordinary build tooling. It holds playwright — the browser that takes every screenshot — and @devup-ui/react, @devup-ui/reset-css, the library whose rendering the whole fidelity corpus measures. Moving either shifts every number in thresholds.json, and worse, makes future changes unattributable: a shift could be a generator improvement or a dependency bump and nobody could tell which. The repo pins renderer identity on purpose (docs/visual-renderer-contract.md).

So I measured all 14 screens before the update, then again after, with the same binary.

Nothing moved. 3.58 / 2.02 / 0.84 · 2.69 · 2.96 · 3.74 / 2.12 / 1.16 · 5.43 / 2.93 / 1.77 · 4.78 / 2.47 / 1.50 — identical to the decimal, before and after.

Two reasons it held: playwright's range ^1.54.0 was already resolving to 1.63.0, so Chromium did not change; and @devup-ui/react (1.0.41) and @devup-ui/reset-css (1.0.28) were already at their latest and were not in the upgrade set at all. Only build tooling moved — vite, the react plugin, TypeScript.

No threshold needed re-baselining. Had any number moved, this would have been a re-baselining PR with the shift recorded, not a silent absorption.

Left alone on purpose

crates/devup-mcp/tests/fixtures/ground-truth-project/package.json is a test fixture representing a real consumer project. It declares no dependencies and must not be "updated" — it is data, not tooling.

Verification

Gate	Result
cargo metadata --locked	0
cargo fmt --all -- --check	0
cargo clippy --locked --workspace --all-targets --all-features -D warnings	0
cargo test --workspace	1118 passed / 0 failed / 2 ignored — unchanged
cargo insta test --check	no drift
cargo test --locked -p devup-mcp --test stdio_smoke	2 passed
plugin npm ci && npm run build + git diff --exit-code -- dist	0
plugin npm run typecheck	0
harness: 14 screens re-measured	identical

The plugin bundle is rebuilt under rspack 2 and committed, and I confirmed that build is still reproducible — two clean builds produce byte-identical output, which is what the bundle gate depends on.

Dependabot #51 and #52 can be closed once this lands.