build: migrate tsup to tsdown, mirroring the official client-bundle preset

- banner/intro/footer three-part closure-factory wrap (verbatim from
  packages/client/tsdown.client.ts), intro now owns var module/exports
- deps.neverBundle/alwaysBundle guards: host keeps production deps
  external, client keeps only module-table specifiers external
- bundle purity gate: any non-requested @deepseek-ai/* value import is
  a build error (INLINE_SAFE / vendored-library / generated-remote
  allowances mirrored)
- NODE_ENV + import.meta.env defines for inlined node-idiom deps
- client sourcemap on, matching the official artifact contract
- client smoke test now runs the bundle verbatim through the
  __ModuleLoader__ handoff instead of slicing the factory body by
  exact output strings (decoupled from bundler layout)

src/client/components/pluginInfo.tsx

@@ -4,8 +4,8 @@
  * entire key/value cell is one hit target. Row 1 (Plugin name + version) →
  * the repo's releases page, row 2 (the short owner/repo label) → the repo
  * root; hovering a row underlines its value. Metadata is baked into the
- * bundle from package.json via tsup `define` (see src/client/meta.ts +
- * tsup.config.ts). One live check rides on top: the card asks the npm
+ * bundle from package.json via tsdown `define` (see src/client/meta.ts +
+ * tsdown.config.ts). One live check rides on top: the card asks the npm
  * registry for the latest published version (cached with a 1-hour TTL, see
  * ../latestVersion.ts) and shows an `↑ vX.Y.Z` chip when it is newer.
  *

src/client/index.ts

@@ -13,8 +13,8 @@
  * standard prop on every session-scope slot component). No polling, no RPC,
  * no client-side cache.
  *
- * This module is the body of the package's `./client` bundle: tsup
- * (tsup.config.ts) bundles it (external `react` — the browser module table
+ * This module is the body of the package's `./client` bundle: tsdown
+ * (tsdown.config.ts) bundles it (external `react` — the browser module table
  * supplies it via the injected `require`) into the web boot handoff
  * (`window.__ModuleLoader__.load({id, factory})`). All imports from other
  * client modules are inlined by the bundler; everything here is zero-runtime

src/client/meta.ts

@@ -1,6 +1,6 @@
 /**
  * Plugin self-metadata for the Plugin info card. Version is substituted at
- * build time (tsup `define` in tsup.config.ts, read from package.json);
+ * build time (tsdown `define` in tsdown.config.ts, read from package.json);
  * the typeof guard keeps a dev/test bundle built without defines working.
  */