build: unpin the dependencies and move to a current vcpkg baseline

[ResurrectedTrader]

Two problems, one fix.

The manifests disagreed with each other. The root one pinned nine packages through an overrides block; tests/frontends/js/vcpkg.json had no overrides at all. Both pin the same builtin-baseline, so anything the overrides held back resolved differently in the two. That matters because src/utils/utils.cpp is compiled into both the DLL and the test binary: it was getting spdlog 1.15.3 in one and 1.16.0 in the other. Five of the nine overrides were pinning a package to the version the baseline already offered, so they were doing nothing.

The baseline was old. Every dependency was held a version or more behind what vcpkg ships.

The overrides block is deleted rather than duplicated into the test manifest. With one baseline and no overrides, every shared dependency resolves identically in both by construction, and there is no second place a version can drift. Reproducibility is unchanged: the baseline is a pinned vcpkg commit, so bumping a version is still deliberate, it just happens in one place.

What moves

Package	Before	After
spdlog	1.15.3	1.17.0#1
fmt	12.0.0	12.2.0#1
sqlite3	3.49.1	3.53.4#1
imgui	1.91.9	1.92.9
ixwebsocket	11.4.6	12.0.1
detours	4.0.1#8	2025-06-20
doctest	2.4.12	2.5.3
nlohmann-json	3.11.3	3.12.0#2
magic-enum	0.9.7	0.9.8
zlib	1.3.1	1.3.2#2

VCPKG_REF in both workflows moves with the baseline. The two have to agree, or CI keys its binary cache on one vcpkg and resolves versions against another.

What broke

One thing. vcpkg's zlib port renamed its static library, so the glue project's explicit zlib.lib / zlibd.lib became zs.lib / zsd.lib.

Nothing else needed touching, which is the surprising part. I expected trouble from two of these: ImGui 1.92 reworked the font and texture API, and ixwebsocket went up a major version. Both compile against our code unchanged.

What the bump lets us delete

ix::HttpServer used to compare the Upgrade header value case-sensitively against "websocket". The browser-side proxy that chrome://inspect's inspect link attaches through sends Upgrade: WebSocket, so every click-inspect upgrade fell through to the HTTP handler and 404'd. ix::HttpServer is final, so the inspector carried DualModeServer, a reimplementation of that whole dispatch on ix::WebSocketServer with a case-insensitive check.

We sent the fix upstream and it is in 12.0.1, citing the same Chrome proxy behaviour. The subclass is gone and InspectorServer uses ix::HttpServer directly, which removes about sixty lines and one place where we were shadowing a library's connection handling.

Inspector, verified live

The ixwebsocket bump and the DualModeServer removal are now exercised against a running game rather than only compiled. A dependency-free CDP client confirmed the discovery endpoints, that both Upgrade: websocket and Upgrade: WebSocket return 101 (the upstream fix we relied on), a full DevTools-style bootstrap answered 12 of 12 with unimplemented domains erroring rather than hanging, and Runtime.evaluate round-tripping. Seven hostile disconnect patterns - reset mid-session, rapid attach cycles, backpressure, half-close, all targets at once, malformed frames, request flood - left the listener serving.

That surfaced two real problems, fixed here.

DevTools opened on an empty Elements panel. The session was attached and answering the whole time; the frontend was drawing the page inspector for a target with no DOM. type decides whether DevTools believes there is a DOM, not the frontend URL, and the two only work together: a "page" target lands on Elements and ignores v8only=true, while js_app.html reads that flag but only receives "node" targets. Changing either half alone yields an empty panel or a window that never attaches. Both halves now match Node's combination.

Rebinding was all-or-nothing. Start probes with SO_EXCLUSIVEADDRUSE so a second multi-boxed instance cannot silently split the port, but it gave up on the first refusal, and a restart from the Settings toggle binds again while the old listener's sockets can still outlive stop(). The probe now retries for two seconds; a port another instance really holds still fails.

docs/inspector.md is updated for both.

Verification

Built from a clean vcpkg tree at the new baseline, with every package rebuilt from source:

Check	Result
build.ps1 Release	succeeded, 0 warnings
build.ps1 Release -Platform x64	succeeded, 0 warnings
build.ps1 test	127 passed
build.ps1 check-format	clean
build.ps1 lint	113 passed, 0 failed

The first CI run after this merges will miss the binary cache for everything and rebuild from source, then repopulate it. Later runs hit it again.