Rejuvenate tooling, CI, and tests

[botre]

What changed

Dependencies

• husky 8 -> 9: prepare script is now husky and the pre-commit hook drops the deprecated shebang and husky.sh sourcing (per the v9 release notes; the v8 format would break in v10).
• Dev React 18 -> 19 (react, react-dom, @types/react, @types/react-dom), so the suite exercises the newest supported peer. React 18 stays supported and is still tested in CI.
• Patch-level bumps: typescript ^5.9.3, vitest ^4.1.10, happy-dom ^20.11.1, @vitejs/plugin-react ^6.0.5.
• Lockfile refresh clears the ws and postcss/vite advisories.

Deliberately not upgraded

• TypeScript 7 (the Go-native compiler, released 2026-07) has no stable programmatic API yet; tsup's dts emit and typescript-eslint-style tooling can't run on it until 7.1. Staying on 5.9.x.

CI

• Check workflow now runs a matrix: Node 20/22/24 x React 18/19 (React swapped in with npm install --no-save before the test step).
• actions/checkout and actions/setup-node bumped to v7. The only breaking change in checkout v7 (blocking fork checkouts for pull_request_target/workflow_run) does not apply to these workflows.

Tests

• Added mocked-fetch tests: request method/headers/body and formId URL-encoding, JSON error body parsing, non-JSON error body kept as raw text, and submitting resetting after a failed submit. 8 tests total, all passing.
• Renamed vitest.config.ts to .mts to silence the CJS-load warning.

README

• Added a requirements line (React 18/19, Node 18+), clarified the error body description, removed em dashes. No typos found beyond that.

Version

• Bumped to 1.0.1. Note the deploy workflow's bump action will bump again on merge; that is the existing flow.

Backward compatibility verification

• Public API untouched: useFormspark, FormsparkError, and the exported types are unchanged.
• Built and packed 1.0.1, downloaded the published 1.0.0 tarball, and compared: file lists are identical, dist/ output is byte-identical, and main/module/typings/peerDependencies/engines are identical.
• Installed both tarballs into throwaway consumers and verified require, import (namespace and named exports match exactly), and an SSR + mocked-fetch smoke test of the hook, against React 19 and React 18.

Remaining risks

• One low-severity advisory remains: transitive esbuild 0.27.7 (Windows dev-server file read, GHSA-g7r4-m6w7-qqqr). The fix is 0.28.1, outside the ^0.27 ranges pinned by tsup and vite; forcing an override risks build breakage for a dev-only, Windows-only issue. Will clear when tsup/vite bump.
• The live-network tests against submit-form.com are kept as-is; they now run 6x per check run due to the matrix.