chore(deps-dev): bump the dev-dependencies group with 10 updates

[tobyhede]

Summary

Minor/patch bumps of 10 dev dependencies (@biomejs/biome 2.5.3 → 2.5.9, @changesets/cli, turbo, @neon-rs/cli 0.1.82 → 0.2.6, @tsconfig/node22, @clerk/backend, @supabase/postgrest-js, @supabase/supabase-js, fta-cli, @types/semver), plus a companion commit that applies Biome 2.5.9's new formatting and safe lint fixes across the repo.

This is Dependabot's #939 re-opened from a maintainer branch. Unlike the sibling dependency PRs, part of its CI failure was real: Biome 2.5.9 changes formatter output and tightens lint rules, so the bump alone fails the Lint (Biome) job and the biome format check inside protect-ffi's test chain. The companion commit is the output of pnpm run code:fix under 2.5.9 — safe fixes only, no manual edits. The remaining Dependabot-run failures (Drizzle integration) were environmental: the Dependabot secrets store lacks USER_JWT/USER_2_JWT, so lock-context tests skip and the no-skip guard fails the job.

Changes

• Dependency bumps: package.json files (root, e2e, protect-ffi, stack, stack-drizzle, stack-supabase, test-kit) and pnpm-lock.yaml (same commit as chore(deps-dev): bump the dev-dependencies group across 1 directory with 10 updates #939, cherry-picked)
• Biome 2.5.9 companion: 58 files reformatted / safe-fixed by pnpm run code:fix (test files, examples, e2e — no source-logic changes)

Verification

• pnpm run code:check under Biome 2.5.9: exit 0, zero errors (200 warnings, which CI allows).
• pnpm --filter @cipherstash/protect-ffi test: passes, including the biome format step that failed on the Dependabot run.
• Credentialed integration suites run in CI on this PR.

Related

• Replaces chore(deps-dev): bump the dev-dependencies group across 1 directory with 10 updates #939 (closed in favour of this PR).

Review notes

• Review the two commits separately: the first is Dependabot's bump verbatim, the second is purely mechanical Biome output.
• No changeset: dev-dependency and formatting changes only, nothing published changes.

https://claude.ai/code/session_01PS9J6pu3FmmQvJHxwTVJUc

[changeset-bot]

⚠️ No Changeset found

Latest commit: 1808110

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[freshtonic]

Approved: the dependency updates are coherent, and the Biome follow-up is structurally formatting-only across tests/test helpers. All checks pass.

[tobyhede]

Rebased onto main after #942–#946 merged. Conflicts were in pnpm-lock.yaml, packages/stack/package.json, and packages/stack-supabase/package.json against #946's production bumps — resolved by taking the newer pin on each side (this branch's @clerk/backend / @supabase/* / fta-cli, main's @types/pg) and regenerating the lockfile with pnpm. Verified: pnpm install --frozen-lockfile passes and pnpm run code:check exits 0 with zero errors on the rebased branch.