Update dependencies and fix what the new lint rules caught

Every package moves to its newest in-major version, plus React 19.3, @convex-dev/auth 0.0.96 and next-plausible 4. The backend declares @auth/core and generates sign-in codes without oslo, which @convex-dev/auth no longer pulls in. The UseSend patch now actually removes the crypto import Convex refuses to bundle. The stricter react-hooks and typescript-eslint rules flagged the carousel, chart, image crop and mobile hook, which now pass.

packages/ui/src/carousel.tsx

@@ -93,6 +93,9 @@ const Carousel = ({
 
   React.useEffect(() => {
     if (!api) return;
+    // Embla is the source of truth for scroll state; read it once on mount,
+    // then follow its events.
+    // eslint-disable-next-line react-hooks/set-state-in-effect
     onSelect(api);
     api.on('reInit', onSelect);
     api.on('select', onSelect);