Modernize the build and convert the client to ES modules

[oskarkrawczyk]

The client was ~10k lines of ES5 AMD modules loaded by a vendored RequireJS
2.1.8, built by Grunt 0.4 against node ~0.12.7, styled with LESS 1.3, and
tested by doctest.js under PhantomJS. npm install no longer resolved on a
current Node at all.

Toolchain:

• esbuild replaces Grunt's copylib/maybeless/substitute/config-requirejs
  chain. One build/build.mjs produces dist/togetherjs.js (IIFE, still a
  drop-in <script src>), dist/togetherjs.min.js (actually minified now —
  the old requirejs task ran with optimize:"none", so togetherjs-min.js
  never was), dist/togetherjs.esm.js for npm, plus separate recorder and
  walkabout entries.
• vitest replaces the doctest.js unit tests; Playwright replaces the
  PhantomJS functional runner and gives us real two-peer coverage.
• ESLint flat config + Prettier replace jshint/csslint.

Sources moved to src/ and converted from define([...]) to import/export.
esbuild cannot consume AMD (it leaves define() as a free call and drops the
dependencies), so the toolchain and the module conversion had to land
together rather than as separate steps.

Two structural changes the single-bundle format forced:

• The entry split into src/core/togetherjs.js (the TogetherJS object,
  config, events) and src/index.js (boot). Under RequireJS the load order
  made the window.TogetherJS global safe to read at module scope; in a
  bundle it is not, so every module now imports TogetherJS explicitly.
• Config reads that used to happen at module scope now happen lazily.
  The bundle evaluates when the <script> runs, which is before the host
  page's configuration has been applied — storagePrefix, includeHashInUrl,
  ignoreMessages and the template language were all being read too early.

Import cycles (session<->ui, peers<->ui) are handled by a small registry in
src/core/registry.js rather than static imports, preserving the deferred
require("ui") semantics the AMD code relied on; a static import would
evaluate ui.js before session.js's body and break its top-level handlers.

Templates and styles:

• All five locales are compiled into the bundle at build time, removing the
  per-locale templates-.js fetch and the load-order race templates.js
  worked around. Untranslated strings are now reported per locale at build
  time.
• The http://localhost:8080 placeholder convention became an explicit
  {{baseUrl}} token.
• LESS is retired. The sources used only variables, four vendor-prefix
  mixins and nesting, but also rule-as-mixin calls that made a hand
  conversion risky, so they were compiled once and committed as plain CSS,
  with obsolete vendor prefixes stripped and the design tokens hoisted into
  :root custom properties.

Fixes found along the way:

• TogetherJS.removeShortcut() called addEventListener, so the alt-T
  shortcut could never be removed.
• _configTrackers was indexed by name, which is the settings object in
  the one-argument config() form, so trackers only ever fired for the
  two-argument form.
• emit() returned early without clearing _listenerOffs, leaving every
  later off() call deferring into a dead array.
• initIdentityId.done was assigned but never read, and fired a storage read
  at load that would have closed storagePrefix before a page could set it.
• youtube.js fetched the YouTube iframe API at module scope, so merely
  including togetherjs.js hit youtube.com; it now waits for session start.
• Errors thrown in the start chain were swallowed by jQuery Deferreds,
  leaving TogetherJS silently half-started; they are surfaced now.

Deleted: Gruntfile, devserver, Travis config, the Firefox addon (built with
cfx, removed from Firefox in 2017), the legacy hub/ server superseded by
hub-worker/, analytics.js (classic ga.js), the vendored require/almond/
jquery/tinycolor copies, and the doctest.js framework.

jQuery is still present, from npm rather than vendored; removing it is the
next step.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01HgRCPNvLVGLYVox8Va8uJh