chore(deps): bump the testing and misc-runtime groups

[orangeboyChen]

Combines dependabot groups #155 (testing) and #122 (misc-runtime) onto one branch — both were blocked on the same Bun / TypeScript / Coverage job, and they touch disjoint dependency sets.

What failed in the original PRs

Neither PR failed for a trivial reason. The visible CI failure was a red Codecov test-results step (No JUnit XML reports found), but that was only a downstream symptom: bun run typecheck exits non-zero, so test:ci never runs and never writes test-report.junit.xml. The real failures were three breaking changes.

Fixes

1. jest-dom matcher types (vitest 5)

import '@testing-library/jest-dom' resolves to types/index.d.ts, which only augments the global jest namespace. @types/jest isn't installed here, so those matcher types were never actually applied — vitest 4 tolerated it, vitest 5's narrower Assertion<> did not, producing 30 TS2339 errors (toBeInTheDocument, toBeVisible, toHaveTextContent) across tests/admin/*.

Switched to @testing-library/jest-dom/vitest, which augments vitest's own Assertion interface.

2. motion held at 12.x (not #122's 13.2.0)

motion 13 is not usable yet: @lobehub/ui 5.47.1 (the latest) still declares motion: ^12.0.0, so 13 installs a second nested copy. motion then stops being assignable to MotionComponentType — TS2590 + TS2322 at app/lobe-ui-provider.tsx:62 and four test files.

Bumping to the latest 12.x (12.43.0) keeps a single hoisted copy and typechecks clean. overrides did not solve this — @lobehub/ui takes motion as a hard dependency, so I reverted that. Worth re-checking once @lobehub/ui supports motion 13.

3. AuthenticatorTransportFuture removed (simplewebauthn 14)

lib/server/admin/session.ts imported a type that v14 dropped; v14 also widened transports to plain string[]. Changed the stored field to string[]. This is correct at runtime, not just type-level: transports are advisory metadata forwarded between the browser and stored credentials.

Verification

Full ci-pr.yml gate run locally, all green:

Step	Result
bun run lint	pass
bun run format:check	pass
bun run typecheck	pass
bun run test:ci	753 tests pass; coverage 94.6% stmts / 89.6% branches / 94.9% funcs / 95.3% lines (gates: 90/70/90/90)
test:patch-branches	100%
bun run build	pass

test-report.junit.xml is now produced (175 KB, 753 tests), which resolves the Codecov step that was red on both original PRs.

Notes

• bun.lock diff is deliberately small (+5/-13): the nested @lobehub/ui/motion entries are removed rather than the whole lockfile being re-resolved through a different registry. Verified reproducible with rm -rf node_modules bun.lock && bun install --frozen-lockfile.
• Deferred: bun pm untrusted reports 3 blocked postinstalls (@parcel/watcher, @swc/core, unrs-resolver). These are pre-existing transitive deps of next/eslint, unrelated to this bump.

Closes #155
Closes #122

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.57%. Comparing base (12f98c1) to head (b6f8d8f).
⚠️ Report is 2 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #161      +/-   ##
==========================================
+ Coverage   95.52%   95.57%   +0.05%     
==========================================
  Files          37       37              
  Lines        6706     6738      +32     
  Branches     1933     1944      +11     
==========================================
+ Hits         6406     6440      +34     
+ Misses        300      298       -2     

Flag	Coverage Δ
unittests	95.57% <ø> (+0.05%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.