Cut 1.0.0: native fetch, FormsparkError, modern toolchain + CI tests

[botre]

Summary

Audit-driven hardening pass. Ships a coherent 1.0.0 that fixes real bugs, modernizes the toolchain, and adds end-to-end tests in one breaking release.

Runtime

• Reject with FormsparkError (carrying status + parsed body) on non-2xx responses. Was previously resolving with the error body, so consumers couldn't tell a successful submit from a 422.
• encodeURIComponent the formId before path interpolation.
• Drop the whatwg-fetch polyfill: native fetch is universal across modern browsers, React Native, and Node 18+.
• Memoize submit via useCallback([formId]) and destructure formId at hook entry — stable identity across renders.

Build

• Replace unmaintained tsdx (46 npm advisories, last release 2020) with tsup.
• npm audit: 46 vulnerabilities → 0.
• Drop tslib / importHelpers; tsup handles helpers itself.
• Bump engines.node to >=18, TypeScript to 5, moduleResolution to bundler, target to ES2022.

Tests (new)

• tests/use-formspark.test.tsx with four cases:
  • Real-network: posts to https://submit-form.com/echo and verifies the echoed payload.
  • Real-network: posts to a non-existent form ID and verifies FormsparkError + status 404.
  • Submitting state toggles true during the call and false after.
  • submit reference is stable across renders for the same formId.
• vitest + @testing-library/react + happy-dom; 15s per-test timeout for network jitter.

CI

• actions/checkout v2 → v6, actions/setup-node v2 → v6, Node 16 → 22, cache: 'npm'.
• New pull-request.yml workflow runs lint + build + test on PRs against master.
• continuous-deployment.yml now runs npm test before bump/publish.
• Pin phips28/gh-action-bump-version@master → @v11.0.7 (no more moving-branch ref).
• Replace tsdx lint in the husky pre-commit hook with tsc --noEmit.

README

• Fix # Yarn trailing whitespace.
• Rewrite the form-ID / action-URL note.
• Add a slim Error handling section.

Peer deps

• Drop React 16/17 from peerDependencies — now ^18.0.0 || ^19.0.0.

Breaking changes

• Non-2xx responses now throw FormsparkError instead of resolving silently.
• whatwg-fetch is no longer bundled. Polyfill manually if targeting pre-fetch runtimes.
• engines.node is now >=18.
• peerDependencies.react no longer accepts 16.x or 17.x.

Test plan

• npm install — 0 vulnerabilities
• npm run lint (tsc --noEmit) — clean
• npm run build — emits CJS + ESM + .d.ts (~2 KB)
• npm test — 4/4 passing locally, including live /echo and 404 calls
• First merge to master will trigger the updated CD workflow — verify phips28/gh-action-bump-version@v11.0.7 accepts the existing tag-prefix: '' input
• Confirm NPM_TOKEN secret is still valid