Modernize tooling: upgrade deps, switch to vitest and biome

[linusnorton]

Summary

Maintenance PR that does three things:

1. Dependency upgrades & docs

• Bump gtfs-stream 2.2.0 → 3.0.0 — fixes the silent finish/end failure from loadGTFS doesn't work. #17 (3.0 uses pumpify.obj which forwards end/error correctly; verified by loading the Google sample feed end-to-end) and resolves the critical protobufjs RCE vuln chain.
• Patch/minor bumps: mysql2, @types/chai, @typescript-eslint/*, ts-node.
• npm audit fix cleans up transitive vulns in minimatch, flatted, picomatch, ajv, glob, brace-expansion — supersedes dependabot PRs Bump minimatch #27, Bump flatted from 3.3.3 to 3.4.2 #28, Bump picomatch from 2.3.1 to 2.3.2 #29, Bump protobufjs and gtfs-stream #30.
• Fix README examples per Readme example doesn't work, argument mismatch? #19: drop bogus calendars destructure and the stray 4th argument to RaptorAlgorithmFactory.create. Bump Node requirement to 20+ (chai 6 is ESM-only; Node 16 EOL 2024-04, Node 18 EOL 2025-04).

2. Tests: mocha + chai → vitest

• Remove mocha, chai, @types/mocha, @types/chai.
• Add vitest. Rewrite 9 .spec.ts files: chai.expect(x).to.equal(y) → expect(x).toBe(y), .to.deep.equal → .toEqual, add import { describe, it, expect } from "vitest".
• Scripts: test → vitest run, watch-test → vitest, gtest → vitest run -t.

3. Lint: eslint → biome

• Remove eslint, @typescript-eslint/eslint-plugin, @typescript-eslint/parser, .eslintrc.json.
• Add @biomejs/biome and biome.json (linter only; formatter disabled so we don't churn project whitespace). Disable a few rules that conflicted with intentional style (noNonNullAssertion, noStaticOnlyClass, noPrototypeBuiltins).
• Apply safe biome autofixes across the codebase: useImportType, useNodejsImportProtocol, useTemplate, Object.hasOwn instead of Object.prototype.hasOwnProperty.call, etc.
• tsconfig.json: add skipLibCheck: true (needed for vitest/vite type chain).

Verification

• npm test (lint + vitest) passes — 48 tests, 9 files
• npx tsc --noEmit clean
• Smoke test: loadGTFS against the Google sample GTFS feed loads successfully (11 trips, 9 stops, end fires — confirming loadGTFS doesn't work. #17 is resolved)
• npm audit: 12 → 0 vulnerabilities
• CI green on Node 20/22/24 (matrix already updated in 3776630)

Closes / supersedes

• Closes loadGTFS doesn't work. #17 (gtfs-stream silent failure, fixed by 3.0 bump)
• Closes Readme example doesn't work, argument mismatch? #19 (README example mismatch)
• Supersedes Bump minimatch #27, Bump flatted from 3.3.3 to 3.4.2 #28, Bump picomatch from 2.3.1 to 2.3.2 #29, Bump protobufjs and gtfs-stream #30 (dependabot PRs — safe to close after merge)