chore(deps): audit and upgrade all package dependencies

[bntvllnt]

Outcome

Audit and upgrade all dependencies of typescript to the latest compatible, supported versions, including runtime, development, optional and peer dependency ranges. Evaluate available major upgrades explicitly rather than silently excluding them.

Scope

• Inspect current main, package manifests, lockfiles, package-manager/Node requirements, repository instructions, and existing dependency PRs before editing. Reuse or supersede existing work without duplicating it.
• Inventory outdated dependencies and security advisories; record current → proposed versions, compatibility constraints, and deferred upgrades with reasons.
• Upgrade direct dependencies and resolve affected transitive advisories using supported upstream releases. Do not force incompatible overrides or weaken security/lint/type/coverage gates.
• Regenerate lockfiles with the repository-pinned package manager; preserve independent repository/package boundaries. Do not manually edit generated Convex bindings; regenerate with the CLI if required.
• Update compatibility, migration and changelog documentation where behavior or minimum supported versions change.

Acceptance criteria

• All dependency categories audited; latest compatible versions adopted, with any deferred majors/advisories explicitly explained.
• Frozen installation succeeds from the updated lockfile on supported Node/package-manager versions.
• Applicable strict lint, typechecks, build, full tests and existing coverage thresholds pass without exemptions.
• Packed-package consumer checks verify exports/types/runtime compatibility, including optional entries where shipped.
• Dependency/security audit rerun; remaining findings classified by runtime versus development reachability with owner/next action.
• Independent review and required CI pass on the final PR head; no unrelated changes.

Release boundary

This issue authorizes preparation and verification, not stable release, production deployment, credential changes or automatic merging. Follow the repository's reviewed canary/release workflow after separately authorized landing. No npm publication solely to close this issue.