deps: land nine major upgrades with one lockfile

[Aymericr]

What does this PR do?

Combines the changes of nine major-upgrade PRs into one branch off main (after #1058), with a single regenerated bun.lock, so they don't conflict with each other in the lockfile. Supersedes #1060, #1062, #1063, #1064, #1065, #1066, #1067, #1068 and #1069. Those PRs are left open, and their descriptions hold the full breaking-change notes. #1061 (@types/three 0.186) is not included; it's still blocked on the pool plugin.

Superseded PR	Upgrade	Source changes carried over
#1060	typescript 6.0.3 → 7.0.2	the metadata scanner and the ESM import fixer use the 6.0 API from @typescript/typescript6; eslint-config keeps typescript 6.0.3
#1062	@types/node 22 → 26	none
#1063	nanoid 5 → 6	root engines.node goes to >=22, and SETUP.md and CONTRIBUTING.md say Node.js 22+
#1064	motion 12 → 14	none
#1065	eslint-plugin-react-hooks 5 → 7	none (React Compiler rules are now on in recommended)
#1066	eslint 9 → 10, @eslint/js 9 → 10	shared configs pin settings.react.version: '19.3', because eslint-plugin-react's 'detect' calls the removed context.getFilename()
#1067	globals 16 → 17	none
#1068	pdfkit 0.19 → 0.20	the floor-plan export imports pdfkit and registers the standard fonts the browser build requires; adds pdfkit-standard-fonts.d.ts
#1069	react-grab 0.1.50 → 0.2.0	none

One change not in any of the individual PRs. Combining TypeScript 7 with ESLint showed that typescript-eslint, which is hoisted to the root, aborts with "typescript-eslint does not support TS 7.0". #1060 had this latent problem too, but CI doesn't run ESLint. Following the TS 7 side-by-side guidance, the root typescript devDependency is now npm:@typescript/typescript6@6.0.2. Every workspace still declares typescript 7.0.2, gets its own nested copy, and compiles with TS 7 (bunx tsc --version in a package prints 7.0.2).

How to test

1. bun install (the lockfile should stay unchanged)
2. bun run ci
3. cd packages/ui && bun run lint. Expect it to be clean.

Screenshots / screen recording

N/A — non-visual change

Checklist

• I've tested this locally with bun dev
• My code follows the existing code style (run bun check to verify)
• I've updated relevant documentation (if applicable)
• This PR targets the main branch

Local results: check, skills:validate, check-types, build and packages/ui lint all pass. turbo run test --continue has no failures beyond the ones a clean main checkout shows in this environment (GitHub CI for main is green). The combined package.json changes were checked to be exactly the union of the nine PRs' changes.