build: update electron to 43 and keep node_modules out of the asar

Electron 40 is affected by GHSA-9f4c-93c8-jc8g (CVSS 7.2): a sandboxed iframe
can bypass the allow-popups restriction through the OpenURL navigation path.
Motionity renders no iframes, so the practical exposure was near zero, but
Electron only patches its latest three majors — on 40 there would be no fix for
the next advisory either. npm audit now reports zero vulnerabilities.

electron/main.js needed no changes: it uses only APIs stable across 40 to 43.

While verifying the packaged output, the asar turned out to carry @ffmpeg's
transitive dependencies (node-fetch, whatwg-url, regenerator-runtime and
friends). The app loads the vendored UMD bundle from src/vendor/ffmpeg/ and
requires nothing outside electron and node builtins, so build.files now excludes
node_modules wholesale instead of naming @ffmpeg — the same result without
having to track a dependency tree that is not ours.

Verified: electron-builder 26.15.3 packages electron 43.4.0, and the asar
contains the five vendored ffmpeg files and zero node_modules entries.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

PACKAGING.md

@@ -36,9 +36,10 @@ Two consequences worth knowing:
   Pixabay, Unsplash and Google Fonts requests the editor makes.
 - The two `@ffmpeg/*` packages are `dependencies`, not `devDependencies`, so the
   Docker vendor stage can `npm ci --omit=dev` without pulling in electron. That
-  would make electron-builder bundle them into the asar as well, so
-  `build.files` excludes `node_modules/@ffmpeg/**` — the copies under
-  `src/vendor/ffmpeg/` are the ones the app loads.
+  makes electron-builder want to bundle them into the asar too, so `build.files`
+  excludes `node_modules/**` outright — the packaged app requires nothing but
+  `electron` and node builtins, and the copies it loads live in
+  `src/vendor/ffmpeg/`.
 
 The Docker build runs `npm ci` and the vendor step inside the image, so it is
 the one target where you can skip both locally.