fix: lock toolchain against dependabot major bumps (eslint <10, tsparticles ~3.9)

CI after the overlay fix exposed two regressions from dependabot
auto-merges:
- eslint back to ^10 (crashes eslint-plugin-react: display-name
  getFilename) -> >=9.24.0 <10 (9.0/9.20 lack eslint/config export)
- @tsparticles/engine+slim to ^4 (v4 API drift breaks sparkles.tsx),
  and mixing ^3.0 with slim's nested 3.9.1 broke Engine type identity
  -> all pinned ~3.9.0 so bun hoists a single engine copy

Verified locally: lint/typecheck/test/build/format all green.

package.json

@@ -34,9 +34,9 @@
     "@tabler/icons-react": "^3.47.0",
     "@tanstack/react-query": "^5.103.1",
     "@tanstack/react-table": "^9.2.4",
-    "@tsparticles/engine": "^4",
-    "@tsparticles/react": "^3",
-    "@tsparticles/slim": "^4",
+    "@tsparticles/engine": "~3.9.0",
+    "@tsparticles/react": "~3.0.0",
+    "@tsparticles/slim": "~3.9.0",
     "better-auth": "^1.7.5",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
@@ -81,7 +81,7 @@
     "@types/react": "^19",
     "@types/react-dom": "^19",
     "@vitest/coverage-v8": "^5.0.1",
-    "eslint": "^9.0.0",
+    "eslint": ">=9.24.0 <10",
     "eslint-config-next": "16.3.5",
     "eslint-plugin-react": "^7.37.5",
     "husky": "^9.1.7",