build: fix packaged-app startup (npm migration + dependency boundary + smoke gate)

[mrsibe]

Problem

The packaged application could not start, and nothing in the pipeline could tell us:
typecheck, build and build:unpack all passed on artifacts that crashed on the
user's machine.

This was a layered failure:

1. electron-builder's node-module collector + pnpm. Against pnpm's virtual store the
   collector silently dropped transitive production dependencies. v1.2.1 shipped an
   app.asar whose AI paths died with Cannot find module 'eventsource-parser/stream',
   and jsdom -> whatwg-url -> tr46, http-proxy-agent -> debug -> ms,
   util-deprecate, wrappy had been hand-promoted into dependencies as a workaround.
2. The follow-up workaround made it worse. 725b4a3 bundled every bundleable
   main-process package by moving it to devDependencies. That fixed the missing
   modules but broke startup twice over, because two packages cannot be inlined safely:
   • anki-apkg-export - rollup hoisted its dead webpack-only
     require('script-loader!sql.js') to the top of the bundle;
   • pdfjs-dist - its module-scope new DOMMatrix() could not polyfill from
     @napi-rs/canvas, which was never shipped either.

Fixing the first crash only exposed the second, because the bundle aborted before
evaluation ever reached it.

The dependency boundary this restores

package.json `dependencies`  -> external at runtime, must be in app.asar
                                (electron-vite build.externalizeDeps defaults to true)
package.json `devDependencies` -> bundled into out/main by rollup

dependencies is only for packages rollup genuinely cannot inline:

package	why it cannot be bundled
better-sqlite3, sqlite-vec	real binaries; asarUnpack keeps them loadable
jsdom	rollup's commonjs plugin cannot parse a generated file in cssstyle
@mixmark-io/domino	turndown requires it while its module body runs
anki-apkg-export	webpack-only conditional require gets hoisted to bundle top
pdfjs-dist	needs createRequire(import.meta.url) + the optional @napi-rs/canvas

Everything else is bundled, and allowMissingDependencies: false now turns any future
collector miss into a build failure instead of a runtime MODULE_NOT_FOUND.

Commits

9f1a80e - replace pnpm with npm, and fail loudly on a missed dependency

• pnpm -> npm for dev, CI and packaging; pnpm-lock.yaml -> package-lock.json.
• .npmrc: drop shamefully-hoist / node-linker (npm warned about both).
• Delete the five hand-promoted transitive workarounds. Verified they still land in the
  packaged asar as ordinary transitives of jsdom.
• electron-builder.yml: add allowMissingDependencies: false (needs
  electron-builder >= 26.16.0, hence the bump from ^26.4.0), and drop
  npmRebuild: false so native modules are rebuilt for the target Electron ABI and
  target arch during packaging (build:mac --arm64).
• Dependency hygiene: drop @types/dompurify (deprecated stub), @types/react-router-dom@5
  (v7 ships its own types), a duplicate jsdom entry, and the unused
  ollama-ai-provider (code imports ollama-ai-provider-v2).

59b3dd6 - externalize anki-apkg-export and pdfjs-dist for the main process

• anki-apkg-export: restoring the Node branch removes the hoisted script-loader!sql.js.
  Its sql.js is 0.5.0's asm.js build, so no .wasm is involved.
• pdfjs-dist: added to dependencies so it resolves its own optional native peer.
  @napi-rs/canvas + platform binary are now collected (12 files) and the .node is
  unpacked. Also corrected the electron.vite.config.ts comment that claimed pdfjs
  "degrades gracefully without @napi-rs/canvas" - it does not; the dependency is
  required at module scope regardless of whether the app renders.

0172c36 - replace the community Qwen provider with @ai-sdk/alibaba

• qwen-ai-provider@0.1.1 is an AI SDK v4 era provider (provider-utils@2, peer
  zod ^3) in an AI SDK 5 app. It only installed thanks to a hand-written npm
  overrides entry, now deleted.
• Version trap: @ai-sdk/alibaba publishes dist-tags per AI SDK major. latest
  (2.0.54) targets AI SDK 6+ and would silently drag the whole SDK to v6. Pinned to the
  ai-v5 tag, ^0.0.31, whose dependency set (provider 2.0.5 / provider-utils 3.0.39)
  is exactly what ai@5 already resolves.

11d162b - fix anki-apkg-export CJS interop

• Its factory lives on exports.default. With the package external, rollup emits a bare
  require("anki-apkg-export") and does not unwrap it, so every export threw
  TypeError: AnkiExport is not a constructor. Latent since 725b4a3, hidden behind the
  module-load crash that preceded it. Found by the smoke test below.

a2b43dc - packaged-app smoke test gate

• --smoke-test runs the real packaged executable, exercises the paths that have
  actually broken, and exits with a status code:
  • better-sqlite3 + the sqlite-vec extension load; drizzle migrations apply;
    vec_version() answers;
  • a full upsert + KNN query + delete round trip through the app's own
    SQLiteVectorStore (the extension is used, not merely loaded);
  • jsdom parses a document;
  • pdfjs-dist loads (proves its DOMMatrix polyfill found @napi-rs/canvas);
  • anki-apkg-export writes a real .apkg.
• npm run smoke:packaged drives it via scripts/smoke-packaged.mjs, which locates the
  unpacked binary per platform, propagates the exit code and enforces a timeout.
• The launcher points --user-data-dir at a throwaway temp directory, because startup
  opens and migrates a real SQLite database and a smoke test must never touch a
  developer's own ~/.config/knownote.

Verification

CI gate (.github/workflows/verify.yml, added by a5da28f)

npm ci -> typecheck -> build:unpack -> smoke:packaged on three platforms.
All green: run 35963026715.

platform	packaged artifact	native module loaded at runtime
macOS arm64	dist/mac-arm64/KnowNote.app	sqlite-vec-darwin-arm64/vec0.dylib
Windows x64	dist/win-unpacked/knownote.exe	sqlite-vec-windows-x64/vec0.dll
Linux x64	dist/linux-unpacked/knownote	sqlite-vec-linux-x64/vec0.so

Each platform ran the real packaged executable and passed all 11 checks, so
better-sqlite3, sqlite-vec and @napi-rs/canvas (via pdfjs's DOMMatrix
polyfill) are confirmed to load per-architecture, which is exactly what a
Linux-only result could not tell us.

Other checks

• electron-builder's collector reports pm=npm and allowMissingDependencies
  does not trip.
• Normal startup is unaffected by the smoke-test hook: DB initialized, all IPC
  handlers registered, shortcuts registered, no fatal errors.
• test/ and scripts/ do not reach the package: 0 files from either in the asar.
• The gate genuinely fails when it should: hiding the unpacked vec0.so makes it
  exit 1 with cannot open shared object file.
• eslint is back to its previous baseline (6 pre-existing renderer react-hooks
  errors, 156 warnings).

Not verified / follow-ups

• Live AI provider calls. The Qwen provider constructs and returns
  specificationVersion: v2 models for both chat and embeddings, and the
  dependency graph is now clean, but no request has been made against a real
  DashScope key. Deliberately not a merge blocker: CI should not depend on a
  live third-party service. Worth one manual generateText before release. Note
  @ai-sdk/alibaba sends embeddings to DashScope's native endpoint rather than
  the OpenAI-compatible base URL used for chat.
• Version drift. Regenerating the lockfile with npm resolves every ^ range to
  its latest satisfying release (zod 4.3.6 -> 4.6.5, ai 5.0.123 -> 5.0.265,
  electron 39.4.0 -> 39.8.10). Worth a look before the next tag; npm ci pins
  these from here on.
• Pre-existing, not touched here: importing a local .html file through the
  normal document flow cannot work - FileParserService dispatches by extension
  and WebLoader.loadFromPath() throws by design, since WebLoader consumes
  fetched HTML through loadFromBuffer. The smoke test exercises the working
  (fetch/Readability) path.
• Separate follow-ups, intentionally out of scope: the pi-lens/editor
  TypeScript project-discovery issue, and any jsdom -> linkedom, Forge or
  major-version migrations.