chore(tooling): add vitest + svelte-check, drop yarn.lock, CI gates, typed env imports

Toolchain hygiene:
  - svelte-check is now a pinned devDep (was npx-fetched per CI run)
  - vitest + coverage as devDeps; vitest.config.ts is separate from
    vite.config.ts so vite build does not pull vitest
  - $env stub for vitest (alias resolves $env/dynamic/{public,private}
    to a process.env proxy) — keeps server modules testable without
    booting SvelteKit
  - npm scripts: check / check:watch / typecheck / test / test:watch
  - drop yarn.lock + packageManager field; CI uses npm ci, single source
    of truth is package-lock.json
  - CI runs generate:icons + svelte-check + tsc --noEmit before deploy

Switch from raw process.env.X to $env/dynamic/{public,private} in
file-cache, image-cache, transform-cache and rusty-image.server. The
typed imports get tree-shaken correctly per server/client and fail
loudly at build time on accidental client-side use of private vars.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

vitest.config.ts

@@ -0,0 +1,24 @@
+import { defineConfig } from 'vitest/config';
+import path from 'node:path';
+
+/**
+ * Vitest läuft ohne SvelteKit-Plugin (zu schwer für Unit-Tests, zu viele
+ * Initialisierungsschritte). `$env/dynamic/{public,private}`-Imports werden
+ * stattdessen auf Stub-Module gemappt, die `process.env` direkt durchreichen.
+ * Damit lassen sich Server-Module isoliert testen, ohne das volle
+ * SvelteKit-Boot durchlaufen zu müssen.
+ */
+export default defineConfig({
+  resolve: {
+    alias: {
+      $lib: path.resolve(__dirname, 'src/lib'),
+      '$env/dynamic/public': path.resolve(__dirname, 'src/lib/_test/env-stub.ts'),
+      '$env/dynamic/private': path.resolve(__dirname, 'src/lib/_test/env-stub.ts'),
+    },
+  },
+  test: {
+    include: ['src/**/*.{test,spec}.{ts,js}'],
+    environment: 'node',
+    globals: false,
+  },
+});