chore(web): upgrade to SvelteKit 2.70 and clear v3 deprecations

[flamboh]

Note

🤖 Claude Opus 5.5 on behalf of Oliver

Layer 1 of 4 in the infra stack (#114 → #115 → #116 → #117). This moves the dashboard to the latest SvelteKit 2 release and clears the deprecations SvelteKit 3 rejects, so #115 stays small.

What changed

• @sveltejs/kit 2.70.3, svelte 5.57.1, Vite 7.3.6, vite-plugin-svelte 6, plus patch bumps to vitest and svelte-check.
• The 14 API routes return Response.json() instead of kit's deprecated json(). Status codes and bodies are unchanged; JSON responses no longer set an explicit Content-Length.
• The five-minute chart drill-down calls resolve('/netflow/files/[slug]', { slug }), the route-ID form SvelteKit 3 requires.

The rest of the v3 migration ($env/dynamic/private removal, runed removal, Vite 8, build-time DB driver) is in #115.

How to review

Setup: cp datasets.json.example datasets.json, point it at any local pipeline database (or set LOCAL_SQLITE_PATH), then bun run dev:web.

1. Open /, a dataset dashboard, and /netflow/files. All render without console errors.
2. Five-minute drill-down: on a dataset dashboard, narrow the range until the traffic chart shows 5-minute buckets and click a point. The browser navigates to /netflow/files/<YYYYMMDDHHmm> and the file details page loads.
3. Expected error responses, each with a JSON { "error": ... } body:
   • 400: /api/netflow/coverage?granularity=5m (no routers), or /api/netflow/files/abc/details (bad slug).
   • 404: /api/netflow/files/<12-digit slug with no data, e.g. 200001010000>/details.
   • 500: point LOCAL_SQLITE_PATH at an empty SQLite file and request /api/netflow/files/<valid slug>/details; the body is {"error":"Failed to fetch file details"}.

Verification

• Automated: bun run format, bun run lint, bun run typecheck, bun run test:web, bun run build:web, and bun run test:e2e pass; CI is green.
• Manual (remaining): steps 1–3 above against a real dataset.

---

Claude Opus 5.5 · Claude Code (T3 Code)

Rebased onto the merged MAAD stack

Now on main after #107–#120 merged. Response.json() now covers all 16 API routes, including the new dimension-stats and maad-status routes. No dependency changes came from the MAAD stack.