feat: upgrade to SvelteKit 3 and adapter-bun

Run the sveltekit-3 migration and finish its manual tasks:

- Move kit config into the sveltekit() Vite plugin; drop svelte.config.js
- Replace $lib with #lib subpath imports
- Declare env vars in src/env.ts and import them from $app/env/{private,public}
- Consolidate param matchers into src/params.ts
- Use error(status, message), Response.json, refreshAll and goto reset/shallow
- Fall back to a full page load when goto rejects a login return path

Switch from adapter-node to adapter-bun: the build script runs Vite under
Bun (the adapter requires it) and the image starts with `bun ./build`.
Runtime env names (PORT, BODY_SIZE_LIMIT, ADDRESS_HEADER, ...) are unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

vite.config.ts

@@ -1,3 +1,5 @@
+import adapter from '@sveltejs/adapter-bun';
+import { vitePreprocess } from '@sveltejs/vite-plugin-svelte';
 import { sveltekit } from '@sveltejs/kit/vite';
 import tailwindcss from '@tailwindcss/vite';
 import { defineConfig } from 'vitest/config';
@@ -5,10 +7,27 @@ import Icons from 'unplugin-icons/vite';
 import { enhancedImages } from '@sveltejs/enhanced-img';
 
 export default defineConfig({
-	plugins: [tailwindcss(), enhancedImages(), sveltekit(), Icons({ compiler: 'svelte' })],
-	test: {
-		include: ['src/**/*.{test,spec}.{js,ts}']
-	},
+	plugins: [
+		tailwindcss(),
+		enhancedImages(),
+		sveltekit({
+			// Consult https://svelte.dev/docs/kit/integrations#preprocessors
+			// for more information about preprocessors
+			preprocess: vitePreprocess(),
+
+			// Production runs `bun ./build` behind Caddy, which terminates TLS. Without
+			// paths.origin the server takes the host from the Host header and assumes
+			// https, which is right for both staging and production from one image.
+			adapter: adapter(),
+
+			csrf: {
+				// Allow form posts from the dev site, which Caddy also serves over https.
+				trustedOrigins: ['https://dev.stanrunge.dev']
+			}
+		}),
+		Icons({ compiler: 'svelte' })
+	],
+	test: { include: ['src/**/*.{test,spec}.{js,ts}'] },
 	server: {
 		host: '127.0.0.1',
 		allowedHosts: ['dev.stanrunge.dev'],