chore: dependency modernization and documentation accuracy sweep

[swimmesberger]

Dependencies

• NuGet:
  • .NET 10 servicing packages to 10.0.12 (Microsoft.Extensions.* to 10.10.0).
  • Microsoft.OpenApi to 2.12.2, the minimum that Microsoft.AspNetCore.OpenApi 10.0.12 now requires.
  • ModelContextProtocol.AspNetCore 1.4 → 2.2 (major): apps that use Elarion.AspNetCore.Mcp will pull in MCP 2.x.
  • Also bumped: gRPC 2.84, OpenTelemetry 1.19, Npgsql EF 10.0.3, OpenFeature 2.14.1, Aspire 13.5.4, xunit v3 4.0.1, Testcontainers 4.15.
  • Microsoft.CodeAnalysis.CSharp stays at 5.6.0 on purpose. SDK 10.0.3xx ships Roslyn 5.6, so a newer version would stop the bundled generators loading (CS9057) for anyone on that SDK. There's a comment in Directory.Packages.props.
• npm:
  • Minor bumps everywhere.
  • TypeScript 6 and Vitest 5 for the client generator and contributions packages. The client generator's tsconfig.json now lists "types": ["node"] because TS 6+ stops including @types automatically. TypeScript 7 was skipped: it has no JS API, and the tests use ts.transpileModule.
  • fumadocs 16.15. Search moves from @orama/orama to fumadocs' zbsearch fork (initOrama → initDB), and llms.txt awaits the now-async llms(source).index().
• GitHub Actions: every uses: pinned to its latest release. setup-dotnet and setup-node had been on mismatched versions across workflows.
• Samples: Aspire AppHost SDK 13.5.4, with ASPIRE010 silenced. The SDK turns the Aspire CLI bundle off by default and the 13.5 hosting package warns about exactly that.

Merged with main (Web Push, #163)

• Microsoft.Extensions.Http to 10.0.12.
• elarion-webpush on TypeScript 6 / Vitest 5 (26/26 tests).
• [GenerateElarionWebPush] properties made init like the other attributes.
• The new Web Push docs came in with the merge and weren't part of the accuracy sweep.

Framework

• Attribute properties are init-only (breaking, in the CHANGELOG): the 54 remaining set properties on framework attributes. Attribute syntax at call sites is unaffected.
• Stale text in source: the ELSG010 message no longer mentions the removed flat Add{Assembly}ScheduledJobs. XML examples on ITenantContext, IGlobalAuthorizationRule, IClientSnapshotContributor and HandlerAttribute now use the current API.
• scripts/release.mjs: only rewrites Elarion package versions, both Version="…" and dotnet add package … --version. It used to overwrite third-party version pins in doc snippets (the OpenApi one had already been broken), and it missed the --version form.

Docs

• Accuracy sweep: capabilities, concepts, reference, getting-started and tutorial pages checked against source. Fixed samples that didn't compile, removed APIs, wrong namespaces and defaults, and outdated descriptions of outbox and inbox behavior.
• Tutorial: now uses Elarion.Pipeline.TransactionDecorator<,> with AddElarionUnitOfWork<BillingDbContext>(). The hand-written decorator it replaces double-wrapped inbox and [Idempotent] handlers, and a cancel arriving after success rolled back finished work.
• Decorator order: the full order is now documented, taken from the generator.
• Other: manifest-generator trigger list, ADR index (all 75 ADRs, statuses corrected), the two SKILL.md copies synced, Node 20.11+ everywhere.

Validation

• Release build: 0 warnings, 0 errors.
• Elarion.Tests: 2139/2139 passed after the merge (one earlier run had 4 intermittent failures that didn't reproduce in 3 reruns), integration tests included (Docker available).
• dotnet pack: all 54 packages.
• npm packages: client generator 39/39 and contributions 30/30; build and pack --dry-run clean for both.
• Billing.Web: tsc -b && vite build succeeds.
• Website on fumadocs 16.15: build clean; check:links passed (9691 references after the merge). Search checked in the dev server: the index loads and a query returns results.