chore: fix audit vulnerabilities

Co-authored-by: Martin Picco <11276821+M-Picco@users.noreply.github.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 3.14.1 to 3.15.2.
- [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/compare/3.14.1...3.15.2)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 3.15.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Pera persisted its WalletConnect v1 session under the fork's default
localStorage key "walletconnect", which every WC v1 wallet library on the
same origin shares. disconnect() removed that key, wiping a co-installed
wallet's session, and another wallet overwriting it fed a foreign session
into reconnectSession().

- Store the session under "PeraWallet.WalletConnect" by passing storageId
  at both connector sites; the constant is the single source of truth.
- Never touch the shared "walletconnect" key again, except for a one-time
  best-effort migration on init that moves a Pera-owned legacy session
  (mobile wallet details with exactly matching accounts) to the new key.
- No new public option: the namespacing is Pera-internal.

Supersedes #137.

Co-authored-by: Martin Picco <11276821+M-Picco@users.noreply.github.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Bumps [cpy-cli](https://github.com/sindresorhus/cpy-cli) from 5.0.0 to 7.0.0.
- [Release notes](https://github.com/sindresorhus/cpy-cli/releases)
- [Commits](https://github.com/sindresorhus/cpy-cli/compare/v5.0.0...v7.0.0)

---
updated-dependencies:
- dependency-name: cpy-cli
  dependency-version: 7.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps [conventional-changelog-conventionalcommits](https://github.com/conventional-changelog/conventional-changelog/tree/HEAD/packages/conventional-changelog-conventionalcommits) from 7.0.2 to 10.4.0.
- [Release notes](https://github.com/conventional-changelog/conventional-changelog/releases)
- [Changelog](https://github.com/conventional-changelog/conventional-changelog/blob/master/packages/conventional-changelog-conventionalcommits/CHANGELOG.md)
- [Commits](https://github.com/conventional-changelog/conventional-changelog/commits/conventional-changelog-conventionalcommits-v10.4.0/packages/conventional-changelog-conventionalcommits)

---
updated-dependencies:
- dependency-name: conventional-changelog-conventionalcommits
  dependency-version: 10.4.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

The algod spec URL was pinned at v3.26.0-stable. Resolve the latest
stable tag at generate time instead, and add codegen-overlay.yaml to
map go-algorand's basics.* x-go-type annotations onto plain Go types --
the spec ships those annotations with no matching x-go-type-import, so
the generated client would otherwise reference a package it never
imports.

Rounds and related fields move from int to uint64 to match. Clamp the
subtractions that this makes unsigned, so an out-of-order round or vote
count yields zero rather than wrapping to ~1.8e19:

  - GetBlockMetrics rejects a window wider than the chain height
  - formatProtocolVote's fail threshold, and its progress denominator,
    which algod omits entirely when no vote is in progress
  - GetExpiresTime's round distance

Status.Merge now reads every optional field through deref(). Which of
them algod actually sends varies with node state -- at the start of a
fast catchup it reports a catchpoint several rounds before any of the
catchpoint counters -- and pinning is no longer there to freeze that
shape.

GenerateCmd returns an error instead of dividing by a zero RoundTime,
which is its value until the node has seen a full metrics window.

* chore: bring over v4 workflows (no docs)

* chore: astro docs

* chore: npm audit

* ci: rm verify_examples

* fix: bump nanoid to 3.3.18 to address GHSA-2v37-7h3g-55p8

* docs: fix broken links and correct stop() and types import usage

* chore: fix package-lock.json

* chore: fix audit

* test: add addresses to balance change tests to avoid parallel conflicts

* chore: restore algokit-utils/types/indexer external in rollup config

* docs: fix uint64 typo in method signature filter example

* docs: fix off-by-one in statusAfterBlock wait example

* docs: fix USDC amount formatting in example to show fractional values

* docs: await pollOnce in cron/lambda examples

* docs: pin USDC example to MainNet to match the hard-coded asset id

* chore: bump fast-uri to 3.1.6 to fix audit advisories

---------

Co-authored-by: Luca Martini <luca.martini@algorand.foundation>

algod.Stop() always called mac.Stop(false), so on macOS --force only
skipped the is-it-running guard and then hit MustBeServiceMsg for a
non-service install. On restart that is worse than not passing the flag
at all: the stop fails, log.Fatal fires, and Start() never runs, leaving
the node down.

Take force as a parameter and pass it through. stop and restart forward
their flag; the two configure callers pass false.

Co-authored-by: Ganainmtech <127313669+Ganainmtech@users.noreply.github.com>