chore: upgrade to svelte 5 and vite 8

Svelte 4.2 to 5.56, Vite 5 to 8, vite-plugin-svelte 3 to 7. The old tree
wouldn't resolve incrementally, because a stale vite-plugin-svelte-inspector
pinned the v3 peer, so this is a clean reinstall.

Clears all 7 npm audit advisories, including a high-severity Rollup path
traversal.

Reactivity moves to runes: $state, $derived, $effect. Event directives
become properties, and main.js uses mount().

Also drops inputElement, a bind:this target nothing ever read.

src/main.js

@@ -1,7 +1,6 @@
+import { mount } from 'svelte';
 import App from './App.svelte';
 
-const app = new App({
+export default mount(App, {
   target: document.getElementById('app'),
 });
-
-export default app;