fix(build): roll back broken packages, pin tailwindcss 4.3.1 only

npm update (c4d4d2bde) silently upgraded @sveltejs/kit (2.53→2.66),
rollup (4.59→4.62), and svelte (5.53→5.56) together, which caused the
SSR production build to fail: rollup received raw .svelte files without
vite-plugin-svelte transforming them (non-deterministic, race condition).

Fix: restore stable package-lock from 468ed61b3, then selectively update
only tailwindcss and its ecosystem (4.2.1→4.3.1) to resolve DEP0205.
Align @tailwindcss/vite constraint to ^4.3.0 to match.

Also adds flowbite-svelte to optimizeDeps.exclude — it ships TypeScript
optional-param syntax in compiled .svelte dist files that esbuild rejects
during dependency pre-bundling (will matter when flowbite-svelte updates).

Build tested: npm run build ✔  |  svelte-check: 0 errors 0 warnings ✔

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

package.json

@@ -104,7 +104,7 @@
         "@floating-ui/dom": "^1.6.0",
         "@lucide/svelte": "^0.*.0",
         "@popperjs/core": "^2.11.0",
-        "@tailwindcss/vite": "^4.1.10",
+        "@tailwindcss/vite": "^4.3.0",
         "dayjs": "^1.11.10",
         "dexie": "^4.0.0",
         "flowbite-svelte": "^1.28.1",

vite.config.ts

@@ -15,8 +15,11 @@ export default defineConfig({
         }
     },
     optimizeDeps: {
-        // Pre-bundle smaller deps; exclude large CJS libs we prefer to handle via SSR/noExternal
-        exclude: ['@codemirror/*'],
+        // flowbite-svelte ships TypeScript optional-param syntax (x?, date?) in its compiled
+        // .svelte dist files. Esbuild's pre-bundler treats them as plain JS and rejects the `?`
+        // syntax. Excluding it here lets vite-plugin-svelte handle it properly instead.
+        // Re-evaluate if flowbite-svelte releases a clean JS dist (check when upgrading).
+        exclude: ['@codemirror/*', 'flowbite-svelte'],
         include: []
     },
     ssr: {