[rbruhn]

Upgrades Digitization Academy to Laravel 13 and replaces Laravel Mix with Vite.

Laravel 13

• laravel/framework ^13.0 (13.39.0), plus minor package updates. Every package resolves on 13.
• The Filament panel uses PreventRequestForgery, Laravel 13's new name for VerifyCsrfToken.
• Moves to the Laravel 11+ layout:
  • Providers are listed in bootstrap/providers.php instead of config/app.php.
  • The api and broadcast channel routes load from bootstrap/app.php.
  • The old Auth, Broadcast, Event and Route service providers and the unused app/Http/Middleware classes are removed.
  • The Super Admin gate moves to AppServiceProvider, and Fortify's home is '/admin'.
• Bug fix: SendEmailVerificationNotification was registered twice on Registered (the old EventServiceProvider plus the framework's), so new users got two verification emails. It's registered once now.
• No session or cache behaviour change: config/session.php and config/cache.php don't set serialization or serializable_classes, so Laravel 13 keeps the old defaults (no forced logouts). The response cache stores JSON.

Vite

• vite.config.js replaces webpack.mix.js. The scripts are now yarn dev and yarn build.
• Blade loads assets with @vite and Vite::asset(). All images under resources/images are versioned in public/build.
• Isotope and imagesLoaded come from npm (isotope-layout, imagesloaded, jquery-bridget) as jQuery plugins, because Vite 8 can't bundle the vendored minified copies. lodash (unused) and the separate postcss dependency are removed.
• The reCAPTCHA partial's script waits for DOMContentLoaded, because Vite's module script is deferred.

Dependencies and security

• Removing laravel-mix/webpack clears all 9 open npm security alerts (webpack-dev-server, webpack-dev-middleware, uuid, elliptic). yarn.lock is down to 82 packages; yarn audit and composer audit are clean.
• Supersedes Dependabot Bump laravel/framework from 12.70.1 to 13.39.0 #130 (laravel/framework 13.39.0) and Bump the javascript-minor-and-patch group with 2 updates #131 (axios 1.21.0, postcss). Close both after this merges.
• Pest stays on 4, which Laravel 13 supports. Pest 5 can be its own upgrade.

Deploy

• CI builds with yarn build and fails if public/build/manifest.json is missing.
• public/build ships with each release instead of being shared, so a rollback also rolls back the assets.
• public/css, js, fonts, images, svg and mix-manifest.json are no longer shared; Filament republishes its own files on each deploy. Neither database has links to /images/, /css/, /js/, /fonts/ or /svg/.
• After the first successful deploy to each server, those old folders under shared/ can be deleted.

Testing

• Pest: 52 passed, 2 skipped. Pint is clean.
• config:cache, route:cache, view:cache and event:cache all succeed.
• Checked locally in the browser: the home, catalog, team, contact and login pages load with no console errors and no broken images. Font Awesome loads, and the accordion and mobile menu work.
• Not checked: the Filament admin while signed in, and yarn dev hot reload.

When this reaches main, put [major] in the merge commit message so the release gets a major version bump.