chore: bump prettier-plugin-svelte 3.5.2 -> 4.0.0

[rubenhensen]

Summary

• Bumps prettier-plugin-svelte 3.5.2 → 4.0.0, which chore: update dependencies #232 deferred because the 4.0.0 plugin crashed on prettier --check (Error: unknown node type: BinaryExpression) for src/lib/components/filesharing/SendButton.svelte.
• Repo-side workaround: move the {@const totalProgress = ...} ternary out of the template into a script-level $derived. The plugin can't format a BinaryExpression inside a {@const} ternary, so the const was the only thing tickling the bug. The rendered behaviour is unchanged.
• Audited 4.0.0's breaking changes: requires Svelte 5 (have ^5.55.9), and drops svelteBracketNewLine / svelteStrictMode config keys. Neither is set in package.json#prettier.

Closes #232.

Test plan

• npm run lint (prettier --check + eslint) — clean
• npx svelte-kit sync && npx svelte-check --threshold warning — 0 errors, 0 warnings
• npm run build — succeeds
• CI green

[dobby-coder]

Code review

Small, narrowly-scoped dep bump (prettier-plugin-svelte 3.5.2 → 4.0.0) with a single repo-side workaround in SendButton.svelte for an upstream plugin bug. PR description is unusually thorough: documents the upstream crash, names the exact AST trigger (BinaryExpression inside a {@const} ternary), audits both 4.0.0 breaking changes (Svelte 5 requirement: satisfied at ^5.55.9; removed config keys: not in use), and includes lint/svelte-check/build evidence. I reproduced npm run lint, npx svelte-check --threshold warning, and npm run build locally — all clean. The {@const} → $derived rewrite is semantically equivalent for the visible value: percentages is always initialized to [], and the length > 0 guard returns 0 in the empty case, so what gets rendered inside {#if Encrypting} is unchanged. Only the {@const} that tripped the plugin existed in the codebase (verified by grep), so no other latent failures lurk. Engine requirement bumps to node>=20 — CI is on Node 24, so fine. The change is genuinely minimal: 18+/13- across package.json, package-lock.json, and one Svelte file. Nothing I'd block on; a couple of nits worth noting.

Additional nits (not tied to a specific line):

• Implicit Node>=20 floor: package.json gains an implicit node>=20 floor via prettier-plugin-svelte 4.0.0's engines field, but the repo itself has no top-level engines key. CI is fine (Node 24), but a contributor on Node 18 would now get an EBADENGINE warning on install with no documented signal that the floor moved. Optional: add "engines": { "node": ">=20" } to package.json so the requirement is visible without spelunking transitive engine fields.
• Upstream tracking link: The upstream prettier-plugin-svelte bug (BinaryExpression inside {@const} ternary) is real but apparently not referenced by issue # in the PR body or commit message. If it has an upstream tracking link, drop it in the PR body so a future maintainer can tell when the workaround can be reverted. If no upstream issue exists yet, consider filing one — the reproducer is small and you've already isolated the AST trigger.
• No automated test for the rewrite: Flagging only for completeness — the repo has no component-level test harness (Playwright is configured for e2e, not for this calculation), and the change is a 1-to-1 expression move, so adding a test scaffold for one expression isn't worth the cost here.

Test results: pass. Ran locally on Node 22.22.2 (CI uses 24): npm ci --legacy-peer-deps (pre-existing svelte-preprocess vs typescript ^6 peer conflict, unrelated to this PR), npx svelte-kit sync, npm run lint (clean), npx svelte-check --threshold warning (0 errors / 0 warnings / 0 files-with-problems across 477 files), npm run build (succeeds). GitHub CI: Svelte Check, Lint, Conventional Commit all green at review time.

Rule compliance

Checked the PR against all applicable rules in ~/dobby-memory/rules/ and the repo-specific notes in ~/dobby-memory/repos/postguard-website/. No rule violations.

Notable compliance highlights:

• Conventional commit title ✓ — chore: bump prettier-plugin-svelte 3.5.2 -> 4.0.0 follows the required format (amannn/action-semantic-pull-request@v5 will accept).
• PR close-issue keywords ✓ — Closes #232 is on its own line, properly linked.
• Dep is used before bumping ✓ — prettier-plugin-svelte is listed under package.json#prettier.plugins and is required for .svelte parsing in lint-staged.
• Tests-required-on-fixes — not applicable; this is a chore: dep bump with a 1-to-1 expression move, not a product fix.
• Docs drift — not applicable; dep bumps are explicitly filtered out by the rule.
• Repo-specific dep-bump gotchas (dep-bump-gotchas.md) — the 2026-05-20 entry deferred this exact bump because no repo-side workaround was apparent at the time; this PR is the documented follow-up and demonstrates that moving the {@const} ternary into a script-level $derived is a viable workaround. Once merged, that gotcha entry should be updated/retired. The husky pre-commit gotcha in the same notes file is not triggered — prettier-plugin-svelte is already listed in package.json#prettier.plugins.

Verdict: comment (no blockers from code review or rule check).