feat: upgrade to SvelteKit 3 and adapter-bun

Run the sveltekit-3 migration and finish its manual tasks:

- Move kit config into the sveltekit() Vite plugin; drop svelte.config.js
- Replace $lib with #lib subpath imports
- Declare env vars in src/env.ts and import them from $app/env/{private,public}
- Consolidate param matchers into src/params.ts
- Use error(status, message), Response.json, refreshAll and goto reset/shallow
- Fall back to a full page load when goto rejects a login return path

Switch from adapter-node to adapter-bun: the build script runs Vite under
Bun (the adapter requires it) and the image starts with `bun ./build`.
Runtime env names (PORT, BODY_SIZE_LIMIT, ADDRESS_HEADER, ...) are unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -16,7 +16,7 @@ that runs at home; setup, settings and the ban-avoidance rules are in
 ## osu! Map Finder
 
 Available at `/projects/spotify-beatmap-finder`. Built with the existing Svelte 5,
-SvelteKit, Tailwind 4, and adapter-node setup. Uses server-only direct `fetch`
+SvelteKit 3, Tailwind 4, and adapter-bun setup. Uses server-only direct `fetch`
 calls; no Spotify/osu! SDK or additional services.
 
 Set these private variables in your local `.env` or deployment environment:
@@ -29,7 +29,7 @@ OSU_CLIENT_SECRET
 ```
 
 Never prefix these with `PUBLIC_` or commit `.env`. Providers read
-`$env/dynamic/private`; the browser receives only display metadata and results.
+`$app/env/private`; the browser receives only display metadata and results.
 The other projects on this personal site retain their own environment requirements.
 
 Supported inputs: song text (`Deftones Change`), Spotify track, playlist, and album
@@ -70,7 +70,7 @@ up to six active searches globally, and 12 budget units per IP per 10 minutes:
 a single track costs one, a playlist/album six. Expired records are cleaned on
 requests; the limiter has a 10,000-record ceiling. It uses `getClientAddress()`,
 never arbitrary forwarded headers; unsupported adapters share a conservative key.
-Configure adapter-node's trusted proxy/client-address settings correctly at deployment.
+Configure adapter-bun's trusted proxy/client-address settings (`ADDRESS_HEADER`, `XFF_DEPTH`) correctly at deployment.
 
 Requests have a 12-second timeout and at most two retries for network errors,
 429s or server errors. Backoff includes jitter. `Retry-After` is honored; delays