Upgrade crates/js/lib dependencies to latest majors

[aram356]

Context

`crates/js/lib` has eight packages with major version updates available. We should bring the JS toolchain current so we stay on supported versions and can pick up ecosystem improvements (eslint 10 rules, vite 8 build improvements, prebid.js 11 API, etc.).

Scope

Package bumps

• `eslint` 9 → 10, `@eslint/js` 9 → 10
• `typescript` 5.9 → 6.0
• `vite` 7 → 8
• `prebid.js` 10 → 11
• `jsdom` 28 → 29, `@types/jsdom` 27 → 28
• `eslint-plugin-unicorn` 62 → 64
• `typescript-eslint` 8.56 → 8.58 (required for TS 6)

Migrations expected

• `eslint-plugin-import` — latest version (2.32.0) still pins `eslint: ^2..^9`, no `^10` support. Blocks the eslint 10 upgrade. Swap to `eslint-plugin-perfectionist` (`sort-imports` covers the one `import/order` rule we use).
• `vite` 8 — dropped bundled esbuild transpiler. Need `esbuild` as an explicit dev dep, or migrate `build-all.mjs` to `transformWithOxc`.
• `typescript` 6 — stricter inference will surface type errors in test files (vitest `Mock<Procedure | Constructable>` no longer assigns to concrete signatures like `navigator.sendBeacon`; prebid 11 narrowed `params` types).
• `prebid.js` 11 — bidder param object shape changed (`bidderParams`, `zone` now live on a different shape), breaks existing test assertions.

New lint rule surfaced

`eslint` 10's recommended `no-useless-assignment` rule catches dead code in `src/core/request.ts`: `opts` is assigned in both branches but never read. This was a latent bug — `RequestAdsOptions.timeout` was part of the public API but never plumbed through. Fix is to wire it through `sendAuction` via `AbortSignal.timeout()`, then enable the rule.

Acceptance criteria

• All eight packages at latest major
• `eslint-plugin-import` replaced with `eslint-plugin-perfectionist`
• `no-useless-assignment` rule enabled, no exceptions
• `RequestAdsOptions.timeout` actually works end-to-end
• `vitest run` passes (282 tests)
• `npm run lint` clean
• `node build-all.mjs` produces all modules
• `npm run format` clean
• Test type tightening done idiomatically (use `Mock` and helper types; avoid `as any` escape hatches)

PR

Addressed in #636.