fix(setup): gate VC++ on Steam detection and consolidate dependency updates

[aaf2tbz]

Summary

Prevent setup from advancing to VC++ until Windows Steam is detected as installed and no installation is in progress.

Changes

• Disable Next until Steam installation is confirmed.
• Recheck Steam status on click and block duplicate clicks during confirmation.
• Clear stale installed state on failed detection or installation retries.
• Add five regression tests covering timing and failure cases.

Validation

• node --test app/tests/setup-steam-gate.cjs: five tests pass.
• cd app && npm run build: passes.
• git diff --check: passes.

Scope / risk

Setup renderer guard plus dependency updates; no C backend, application-version, Wine/graphics-payload, or migration changes. Electron is updated to major version 44 and needs desktop runtime testing. Fresh-install UI testing has not been performed. Revert this commit to restore the previous navigation behavior.

PR Readiness (MANDATORY)

• Compatibility verified with at least one real game (game + launch method noted below)
• No hardcoded paths, secrets, or absolute /Users/... paths introduced
• Config/rules TOML validated if configs/mtsp-rules.toml or DLL maps changed — not changed
• Version metadata (CMakeLists.txt, app/src-c/Makefile, package.json, package-lock.json) in sync if version bumped — no version bump
• Bottle/runtime migration and launch behavior preserved (rollback plan noted if changed) — no changes to these paths
• Docs / compatibility matrix updated for user-facing changes
• Regression test added for each bug fix

Checklist exception rationale

Uses the existing checklist-exception policy for the setup-navigation guard and consolidated dependency updates. Electron 44 has build/type validation but has not been tested interactively. No real-game compatibility or fresh-install manual validation is claimed; automated tests exercise blocked navigation, pending/duplicate clicks, positive detection, stale status, and request failure. No compatibility-matrix entry was added because graphics/game launch behavior is unchanged. The user-visible effect is documented in this PR summary. CI workflow requirements have not been modified.

Consolidated Dependabot updates

Merged the five currently open Dependabot branches into this PR (not directly into main):

• build(deps): bump marked from 18.0.9 to 18.0.11 in /app #560: marked 18.0.11
• build(deps-dev): bump electron from 43.4.0 to 44.0.0 in /app #559: Electron 44.0.0
• build(deps-dev): bump @iconify-json/lucide from 1.2.118 to 1.2.126 in /app #558: @iconify-json/lucide 1.2.126
• build(deps-dev): bump @biomejs/biome from 2.5.8 to 2.5.10 in /app #553: @biomejs/biome 2.5.10
• build(deps-dev): bump @vitejs/plugin-vue from 6.0.7 to 6.0.8 in /app #542: @vitejs/plugin-vue 6.0.8

Resolved adjacent Electron/plugin-vue conflicts in both package manifests by retaining both updates. npm ci, the five setup regression tests, npm run build, npx tsc --noEmit, and git diff --check pass with the combined locked versions. The installed test app has not been changed by this consolidation. Original Dependabot PRs are left open pending merge of this PR.

Security dependency fixes

• Raise the fast-uri override/lock to 3.1.6 (alerts Feature: Beta 5 #64, feat(beta5): DXMT rebuild, dual-Steam, engine consolidation, distribution, Vue frontend rewrite #65, fix: sidebar layout, drag area, steam api key preservation #67, feat: proactive update banner with download+install flow #68).
• Resolve @xmldom/xmldom to 0.8.15 (alert fix: migration stuck on step 2 + ECONNREFUSED race #66).
• Clean npm install, five regression tests, production build, TypeScript, and diff checks pass.
• Updated the tar override/lock to 7.5.21 and nanoid lock to 3.3.18, resolving the remaining denial-of-service advisories and dependent-package audit entries.
• After a clean npm ci, npm audit --json reports zero vulnerabilities. Regression tests, production build, TypeScript, and diff checks pass with the final dependency set.