chore(deps): batch bump JS + Rust dependencies, fix Sunday-flaky activity tests

[ajianaz]

Dependabot opened 10 separate PRs but they all fail the repo gates
(CLA / branch-naming / PR-description jobs run on its branch names).
Consolidated here instead:

JS (bun.lock + package.json):

• marked 18.0.7 -> 18.0.11
• dompurify 3.4.13 -> 3.4.14
• svelte 5.56.8 -> 5.57.0
• @sveltejs/vite-plugin-svelte 7.2.0 -> 7.3.0
• @testing-library/jest-dom 7.0.0 -> 7.0.1

Rust (src-tauri/Cargo.lock, spec ranges unchanged):

• toml 1.1.4+spec-1.1.0 -> 1.1.5+spec-1.1.0
• tauri-plugin-updater 2.10.1 -> 2.11.0
• tauri-plugin-dialog 2.7.2 -> 2.7.3
• tauri-plugin-shell 2.3.5 -> 2.3.6
• tauri-plugin-fs 2.5.1 -> 2.5.2

Also fixes the Sunday-flaky activity tests: assertions assumed future
pad cells exist, which is false when the suite runs on a Sunday (grid
ends today). Tests now pin the clock to a fixed Wednesday via vitest
fake timers - 91/91 green on any day. (#309 note)

What

Dependency batch bump + date-independent activity tests.

Why

Single auditable bump instead of 10 gate-failing dependabot PRs; CI
was red every Sunday from the flaky assertions.

Testing

• 91/91 tests, tsc clean, vite build green (7.07s)
• cargo metadata --locked: lockfile valid (full cargo check blocked
  by missing host glib; CI covers the compile)

[github-actions]

🔍 Cora AI Code Review

✅ No issues found. Code looks good!

---

Review powered by cora-code · BYOK · MIT