chore: sync upstream cella v0.9.1 (c2288183)

[flipvh]

Syncs upstream cellajs/cella to c228818 (v0.9.1).

8 upstream commits since last sync (compare):

• 93bbd15 chore(lint): clear comment-style backlog and make the style pass blocking (chore(lint): clear comment-style backlog and make the style pass blocking cella#1050)
• c73c84b fix(infra): boot-diag empty-bucket guidance and boot.log selection (fix(infra): boot-diag empty-bucket guidance and boot.log selection cella#1049)
• a75b7f2 chore(deps): minor/patch dependency sweep, hold @hono/zod-openapi at 1.5.1 (chore(deps): minor/patch dependency sweep, hold @hono/zod-openapi at 1.5.1 cella#1051)
• 837e570 refactor(auth): replace deprecated arctic and @oslojs packages (refactor(auth): replace deprecated arctic and @oslojs packages cella#1052)
• 960c00f fix(auth): create OAuth client auth lazily so empty secrets don't crash module load (fix(auth): create OAuth client auth lazily so empty secrets don't crash module load cella#1053)
• e297a3c feat(auth): carry post-auth deep-link redirect through magic link, OAuth and MFA (feat(auth): carry post-auth deep-link redirect through magic link, OAuth and MFA cella#1054)
• 848d116 refactor(blocknote): align UI adapter with @blocknote/shadcn 0.53 Base UI contract (refactor(blocknote): align UI adapter with @blocknote/shadcn 0.53 Base UI contract cella#1055)
• c228818 chore(main): release 0.9.1 (chore(main): release 0.9.1 cella#1044)

Fork-side work in this sync

• Drizzle migration 20260814205136_cloudy_proteus: upstream's post-auth redirect (feat(auth): carry post-auth deep-link redirect through magic link, OAuth and MFA cella#1054) adds nullable tokens.redirect_path, and the arctic/oslojs replacement (refactor(auth): replace deprecated arctic and @oslojs packages cella#1052) adds passkeys.counter (NOT NULL DEFAULT 0). backend/drizzle is fork-owned, so the migration is generated here. Both ALTERs are additive and safe on populated tables.
• prosemirror-model dedupe: the BlockNote 0.53 bump left prosemirror-model split across 1.25.7/1.25.11 in the lockfile, breaking typecheck in the fork-owned checklist block. pnpm dedupe prosemirror-model collapsed it to 1.25.11 (-65 duplicate packages).
• Stale dependency cleanup: the package.json section sync does not delete deps upstream removed. Dropped arctic, @oslojs/crypto|otp|webauthn (backend, replaced upstream in refactor(auth): replace deprecated arctic and @oslojs packages cella#1052), @tanstack/ai-openai, react-i18next (backend, unused), @oslojs/encoding + workbox-* (frontend, unused). Adopted upstream versions for @typescript/native-preview (20260707.2) and drizzle-kit (1.0.0-rc.5) across workspaces. Kept lucide-static (used by the fork-owned icon script).
• Bench seed fix (pre-existing, surfaced by the full test run): mockTask emits invented attachments ids since feat!: derive task.attachments from description media blocks, drop attachment.taskId #94, which the bench task seed JSON-stringified into an invalid pg array literal. Seed now sets attachments: [] and declares the column in pgArrayColumns.

Verification

• No merge conflicts left woven in; no fork markers existed in any file this merge touched.
• No new cella migrations shipped with this range; pending list stays empty.
• pnpm check clean; backend suite 88/88 files; full pnpm test green including bench scenarios.
• Drift after commit: diverged 0, behind 0, drifted 7 (unchanged set, all with fork: markers: attachment/blocknote strand, tabs-arrangement-card, shared/index.ts).