Update JS dependencies (covers every open Dependabot PR) - #247

The 21 open Dependabot PRs (#189–#215) can't merge: every one conflicts with main.

• Composer (Bump composer/composer from 2.9.5 to 2.9.8 #207, Bump symfony/dom-crawler from 6.4.34 to 6.4.40 #213, Bump symfony/cache from 6.4.34 to 6.4.41 #214, Bump symfony/yaml from 6.4.34 to 6.4.41 #215): main's composer.lock already has newer versions (Update Composer dev dependencies with security advisories #242).
• npm (the other 17): they edit package-lock.json, which main dropped for bun.lock in Rebuild admin UI with React + Tailwind CSS v4 + shadcn/ui #187.

This PR refreshes bun.lock within the current package.json ranges (bun update), which covers every version those PRs asked for: axios, express/qs, lodash, lodash-es, node-forge, picomatch, PostCSS, follow-redirects, fast-uri, ip-address, basic-ftp, flatted, svgo, immutable, @tootallnate/once and @babel/plugin-transform-modules-systemjs.

• TypeScript pinned to 5. The refresh pulled in a transitive TypeScript 7, which breaks tsc (baseUrl was removed) and typescript-eslint. The project runs tsc but never declared it, so typescript ^5.8.3 is now a devDependency.
• @wordpress/scripts stays on 30 (now 30.27). Bump @tootallnate/once and @wordpress/scripts #191 proposed 31, a major, only to lift @tootallnate/once, which is now at 2.0.1 on 30.x.
• Changelog line included.

Checked locally: PHPCS, WPUnit (108 tests), build, JS/CSS lint, typecheck and Jest (69 tests) all pass. With these packages built on the demo site, Generate works on Posts, Users, Terms, Comments and Attachments, and the admin looks the same as main's build on desktop and mobile.