chore(tooling): add vitest + svelte-check, drop yarn.lock, CI gates, typed env imports

Toolchain hygiene:
  - svelte-check is now a pinned devDep (was npx-fetched per CI run)
  - vitest + coverage as devDeps; vitest.config.ts is separate from
    vite.config.ts so vite build does not pull vitest
  - $env stub for vitest (alias resolves $env/dynamic/{public,private}
    to a process.env proxy) — keeps server modules testable without
    booting SvelteKit
  - npm scripts: check / check:watch / typecheck / test / test:watch
  - drop yarn.lock + packageManager field; CI uses npm ci, single source
    of truth is package-lock.json
  - CI runs generate:icons + svelte-check + tsc --noEmit before deploy

Switch from raw process.env.X to $env/dynamic/{public,private} in
file-cache, image-cache, transform-cache and rusty-image.server. The
typed imports get tree-shaken correctly per server/client and fail
loudly at build time on accidental client-side use of private vars.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/lib/transform-cache.ts

@@ -6,8 +6,10 @@
  * - Optional Datei-Cache: TRANSFORM_CACHE_DIR setzen (z. B. .cache/transform).
  */
 
-const MAX_ENTRIES = Number(process.env.TRANSFORM_CACHE_MAX_ENTRIES) || 100;
-const CACHE_DIR = process.env.TRANSFORM_CACHE_DIR?.trim() || '';
+import { env } from '$env/dynamic/private';
+
+const MAX_ENTRIES = Number(env.TRANSFORM_CACHE_MAX_ENTRIES) || 100;
+const CACHE_DIR = env.TRANSFORM_CACHE_DIR?.trim() || '';
 
 interface CachedImage {
   buffer: ArrayBuffer;