chore: bump version dependencies

[reidzeibel]

Version bump for dependencies that are "safe" to bump.

Dependency updates

• ESLint 8 → 10, @typescript-eslint 6 → 8, plus eslint-config-prettier 10, eslint-plugin-prettier 5.5, eslint-plugin-unused-imports 4
• typescript 5.3 → 5.9, @types/node 20 → 22
• @atb-as/utils 3 → 7, zod 3 → 4 (majors)
• Minor/patch: @hapi/inert, @hapi/catbox-memory, qs, ws, haversine-distance

ESLint flat config migration

ESLint 9+ dropped .eslintrc, so .eslintrc.js and .eslintignore are replaced by eslint.config.js. Rules and ignore patterns carried over unchanged; lint script is now plain eslint .. Lint coverage verified identical (86 files; generated GraphQL types still excluded).

Dependency cleanup — 4 runtime deps removed

• lodash.union, p-limit — unused, no references in the repo
• uuid → crypto.randomUUID()
• lodash.groupby / lodash.sortby → Object.groupBy / toSorted (requires tsconfig lib es2019 → es2024)

Sort ordering was diff-tested against the real lodash.sortBy on mixed numeric/alpha/empty/undefined quay codes — identical output. Added compare-ascending.test.ts to lock the behaviour in.

Regenerated GraphQL types

pnpm gql-gen output for journey-planner v3 and vehicles v2 — additive upstream schema changes (new extraJourney, DatedServiceJourneyReference, ServiceJourneyLocationInput). One removed input field, serviceJourneys, is unused in this codebase.

Deliberately not included

• @hapi/hapi 21.4.x — breaks the build (11 type errors; server-method typings changed)
• hapi-swagger 17.3.x — pulls in @scarf/scarf install-time telemetry and breaks pnpm install's exit code
• @typescript-eslint 8.69.0 — published too recently for the repo's minimumReleaseAge policy; using 8.68.0 so no policy exclusions are needed