Fix Community Review source findings

[vrtmrz]

Aligns DiffZip with the current Obsidian Community Review checks, removing source-code blockers and adding CI protection against recurrence.

Summary

• replace prohibited ESLint suppressions with typed compatibility boundaries for the Smithy HTTP handler, desktop filesystem access, and legacy settings URI encryption
• use Obsidian DOM creation helpers, remove unnecessary production console logging, and clean up deprecated and redundant types
• preserve legacy settings URI compatibility and correctly handle partial binary request bodies
• reproduce the Community Review rules locally, pin dependency installation to npm 10.9.4, and enforce blocker-level findings in CI
• add focused regression coverage for HTTP request bodies and settings URI compatibility

Rationale

The Community Review scanner began rejecting file-wide and deprecated-rule suppressions which the previous local lint configuration did not reproduce. The dependency lockfile also needed to be generated with npm 10 because the review environment rejects npm 11-only lockfile resolutions.

There is no intended user-facing behaviour change. Existing settings URIs remain compatible, and unsupported HTTP request body types now fail explicitly instead of being dispatched incorrectly.

Deferred work

The non-blocking declarative settings API and sentence-case recommendations remain visible in the full Community Review lint output. Migrating the settings tab is separate work because DiffZip still supports Obsidian 1.8.7, while the declarative API is available from Obsidian 1.13.0.

Verification

• npx --yes npm@10.9.4 ci --no-audit --no-fund
• npm run lint
• npm run lint:community -- --quiet
• npm run test:ui -- --maxWorkers=1 — 15 tests passed
• deno task test — 68 tests passed
• npm run test:release
• npm run check:e2e:obsidian
• npm run build
• git diff --check

The build retains the pre-existing Svelte state_referenced_locally warning in SyncRemote.svelte.