chore(tooling): add vitest + svelte-check, drop yarn.lock, CI gates, typed env imports

Toolchain hygiene:
  - svelte-check is now a pinned devDep (was npx-fetched per CI run)
  - vitest + coverage as devDeps; vitest.config.ts is separate from
    vite.config.ts so vite build does not pull vitest
  - $env stub for vitest (alias resolves $env/dynamic/{public,private}
    to a process.env proxy) — keeps server modules testable without
    booting SvelteKit
  - npm scripts: check / check:watch / typecheck / test / test:watch
  - drop yarn.lock + packageManager field; CI uses npm ci, single source
    of truth is package-lock.json
  - CI runs generate:icons + svelte-check + tsc --noEmit before deploy

Switch from raw process.env.X to $env/dynamic/{public,private} in
file-cache, image-cache, transform-cache and rusty-image.server. The
typed imports get tree-shaken correctly per server/client and fail
loudly at build time on accidental client-side use of private vars.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -32,10 +32,14 @@ jobs:
           cache: npm
       - name: Install deps
         run: npm ci
+      - name: Generate icons subset
+        run: npm run generate:icons
       - name: SvelteKit sync
         run: npx svelte-kit sync
-      - name: Typecheck
+      - name: Typecheck (svelte-check)
         run: npx svelte-check --threshold error
+      - name: Typecheck (tsc)
+        run: npx tsc --noEmit
 
   deploy:
     needs: verify