chore(tooling): add vitest + svelte-check, drop yarn.lock, CI gates, typed env imports

Toolchain hygiene:
  - svelte-check is now a pinned devDep (was npx-fetched per CI run)
  - vitest + coverage as devDeps; vitest.config.ts is separate from
    vite.config.ts so vite build does not pull vitest
  - $env stub for vitest (alias resolves $env/dynamic/{public,private}
    to a process.env proxy) — keeps server modules testable without
    booting SvelteKit
  - npm scripts: check / check:watch / typecheck / test / test:watch
  - drop yarn.lock + packageManager field; CI uses npm ci, single source
    of truth is package-lock.json
  - CI runs generate:icons + svelte-check + tsc --noEmit before deploy

Switch from raw process.env.X to $env/dynamic/{public,private} in
file-cache, image-cache, transform-cache and rusty-image.server. The
typed imports get tree-shaken correctly per server/client and fail
loudly at build time on accidental client-side use of private vars.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/lib/_test/env-stub.ts

@@ -0,0 +1,18 @@
+/**
+ * Stub für `$env/dynamic/{public,private}`. Wird ausschließlich von Vitest
+ * via Alias aufgelöst (siehe `vitest.config.ts`). Im Produktivbuild verwendet
+ * SvelteKit das echte Modul.
+ *
+ * Tests können `process.env` direkt setzen — Proxy reicht alle Reads
+ * unverändert durch.
+ */
+export const env = new Proxy({} as Record<string, string | undefined>, {
+  get(_target, prop) {
+    if (typeof prop !== 'string') return undefined;
+    return process.env[prop];
+  },
+  has(_target, prop) {
+    if (typeof prop !== 'string') return false;
+    return prop in process.env;
+  },
+});