chore: bump dev deps to clear Dependabot alerts (#20)

Within-major bumps (pnpm up): tsup 8.1 → 8.5, msw 2.3 → 2.13,
vitest 1.6.0 → 1.6.1, typescript 5.4.5 → 5.9.3, @types/node
20.14 → 20.19, @types/async-retry 1.4.8 → 1.4.9, fastq 1.17 → 1.20.

Transitively clears 6 open Dependabot alerts (all high-severity
rollup and minimatch, plus glob, picomatch, cookie): rollup
→ 4.60.2, picomatch → 4.0.4, cookie → 1.1.1; minimatch and glob
no longer pulled in.

Replaces the legacy `import ... assert { type: "json" }` syntax
with the new `with { type: "json" }` form required by TS 5.9.

Remaining open alerts (#48 vite, #60 tsup) need a vitest major
bump or an upstream tsup fix; tracked as follow-ups.

Author: StefanoGuerrini

package.json

@@ -34,15 +34,15 @@
   "license": "MIT",
   "devDependencies": {
     "@biomejs/biome": "1.8.1",
-    "@types/async-retry": "^1.4.8",
-    "@types/node": "^20.14.2",
-    "msw": "^2.3.1",
-    "tsup": "^8.1.0",
-    "typescript": "^5.4.5",
-    "vitest": "^1.6.0"
+    "@types/async-retry": "^1.4.9",
+    "@types/node": "^20.19.39",
+    "msw": "^2.13.4",
+    "tsup": "^8.5.1",
+    "typescript": "^5.9.3",
+    "vitest": "^1.6.1"
   },
   "dependencies": {
-    "fastq": "^1.17.1",
+    "fastq": "^1.20.1",
     "fetch-retry": "^6.0.0"
   }
 }