DEV-1796: Upgrade to dwolla-web.js v3, React 19, Storybook 8, and refresh dependencies

[ShreyaThapa]

Summary

• dwolla-web.js v3: Updates CDN URL to v3.0.0 and enforces the new breaking requirement that <DwollaCustomerCreate type="receive-only"> must include privacy and terms props (regulatory compliance). The CreateCustomerProps type is now a discriminated union — TypeScript will catch missing props at compile time.
• React 19 peer dependency: Expands peerDependencies to ^18.0.0 || ^19.0.0 for both react and react-dom (fixes install warnings for React 19 users, closes Support React 19 as a Peer Dependency #19).
• Storybook 6 → 8: Fixes the sha.js CVE-2025-9288 critical vulnerability (transitive dep of Storybook 6.5.16). Migrates config to SB8 format, upgrades Introduction.stories.mdx to MDX2-compatible .mdx.
• Dependency refresh: Node 18 (EOL) → 20 LTS, TypeScript 4 → 5, @typescript-eslint 5 → 8, Prettier 2 → 3, Rollup 3 → 4, Husky 8 → 9, lint-staged 13 → 15, React devDeps 18 → 19. CI pnpm version bumped from 7 → 8.
• Test migration: All 11 component tests migrated from react-test-renderer (removed in React 19) to @testing-library/react. Snapshots regenerated.

Breaking change for consumers

<DwollaCustomerCreate type="receive-only"> now requires privacy and terms props:

// Before (v1.1.0) — compiled without error
<DwollaCustomerCreate type="receive-only" firstName="Jane" lastName="Doe" />

// After (v1.2.0) — TypeScript error if privacy/terms omitted
<DwollaCustomerCreate
  type="receive-only"
  firstName="Jane"
  lastName="Doe"
  privacy="https://yourcompany.com/privacy"
  terms="https://yourcompany.com/terms"
/>

Test plan

• pnpm install — no peer dependency errors
• pnpm test:ci — 12 suites, 24 tests, 19 snapshots all pass
• pnpm build:check — TypeScript 5 compilation clean
• pnpm checks — lint and format pass
• pnpm bundle — Rollup 4 produces clean CJS + ESM output in bundle/
• pnpm build-storybook — Storybook 8 builds without errors
• pnpm storybook — open http://localhost:6006, verify Introduction page renders with styled link cards, and all 11 component stories load in the sidebar
• pnpm audit — "No known vulnerabilities found"
• TypeScript check: add <DwollaCustomerCreate type="receive-only" /> without privacy/terms to any .tsx file and confirm a type error is reported, then add the props and confirm it resolves

🤖 Generated with Claude Code