chore(frontend): toolchain migration checkpoint + UI perf optimizations

Checkpoint of the in-progress frontend toolchain work (Vite pinned to ^6 after
the 7/8 rolldown build break, eslint-plugin-svelte v3 navigation/reactivity
fixes, CI/Dockerfile/manifest updates) together with three UI performance
optimizations (verified on the Vite 6 build):

- Critical CSS: move auth.css/music.css off the global path into their route
  chunks (login/device/nextcloud-login, music) -- -25% gzipped critical CSS
  (~5.4 KB) on every non-auth/non-music page load.
- relativeTimeAgo: cache the Intl.RelativeTimeFormat (was rebuilt per call, once
  per row per render) -- 22.7x faster date formatting in large lists.
- Virtualize search results and grouped trash (list view) via VirtualList -- DOM
  rows mounted stay ~constant (~27) instead of O(N) (94.6% fewer for 500 hits).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

frontend/src/routes/+layout.svelte

@@ -1,5 +1,7 @@
 <script lang="ts">
 	import { goto } from '$app/navigation';
+	import { resolve } from '$app/paths';
+	import type { Pathname } from '$app/types';
 	import { page, updated } from '$app/state';
 	import { onMount } from 'svelte';
 	import '$lib/styles/app.css';
@@ -40,8 +42,11 @@
 
 		// Redirect old `#/...` bookmarks to the new path before anything else.
 		if (typeof location !== 'undefined' && location.hash.startsWith('#/')) {
+			// hashUrlToPath returns a dynamic in-app path string; resolve() is typed
+			// for known route ids, so assert it as a Pathname (same precedent as the
+			// post-login redirect target).
 			const mapped = hashUrlToPath(location.hash);
-			if (mapped) await goto(mapped, { replaceState: true });
+			if (mapped) await goto(resolve(mapped as Pathname), { replaceState: true });
 		}
 		await session.load();
 		ready = true;
@@ -53,7 +58,7 @@
 		if (!ready) return;
 		const path = page.url.pathname;
 		if (!session.isAuthenticated && !isPublic(path)) {
-			void goto(`/login?redirect=${encodeURIComponent(path)}`, { replaceState: true });
+			void goto(resolve(`/login?redirect=${encodeURIComponent(path)}`), { replaceState: true });
 		}
 	});
 </script>