Repository health: tokenize refactor, CI hardening, and audit fixes

[undivisible]

Summary

Focused repository-health pass for @tschk/flowtoken-svelte covering code hygiene, DevOps reliability, dependency security, and a few high-confidence performance/correctness fixes. No speculative animation or API behavior changes.

Code hygiene & performance

• Extracted diff/word/char tokenization into a pure tokenize module with unit tests
• Refactored TokenizedText to derive tokens without writing reactive state inside $effect
• Switched character splitting to Array.from for Unicode-safe splits without empty regex fragments
• Shared the Sep type between components and exported tokenize helpers from the package entry

Security

• Added Bun overrides for nanoid (^3.3.17) and cookie (^0.7.2)
• bun audit now reports No vulnerabilities found (was 1 high / 1 low)

DevOps / reliability

• CI concurrency + cancel-in-progress, 15m timeout
• CI now runs check, lint, test, build, build:example, and bun audit
• Added Dependabot for Bun and GitHub Actions
• Root scripts: check, lint, test, format
• Example app gained svelte-kit sync && svelte-check
• Package publish hygiene: sideEffects for CSS, prepublishOnly
• Demo streaming timer cancelled on unmount

Test evidence

bun run format   # prettier --check . → All matched files use Prettier code style!
bun run test     # 9 pass, 0 fail
bun run check    # svelte-check 0 errors/warnings (package + example)
bun run lint     # same as check
bun run build    # svelte-package OK
bun run build:example  # adapter-static wrote site to build ✔
bun audit        # No vulnerabilities found

Scope notes

• Kept changes reviewable and behavior-preserving for streaming token append/reset semantics
• Did not rewrite demo UI/design or Streamdown integration behavior