fix: purge SvelteKit, fix lockfile, fix CI failures

SvelteKit removal (no .svelte files were imported by JSX — all dead code):
- Delete all 38 .svelte component files and .svelte-kit/
- Rewrite i18n.js from svelte/store writable/derived → Zustand store
- Rewrite useI18n.js to consume i18n Zustand store directly
- Replace svelte/store in ml-kem-call-manager.js with inline writable()
- Rewrite test-auth.js without svelte/store
- Remove svelte/store webpack alias from next.config.js; delete shim
- Replace @sveltejs/kit JSDoc types with next/server types in API routes

Lockfile: re-lock @profullstack/autoblog against github tarball (has ./feeds)

CI:
- postinstall: guard pnpm dlx with command -v pnpm || true
- Add .semgrepignore to exclude .next/ from semgrep scans

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: ralyodio