build: update electron to 43 and keep node_modules out of the asar

Electron 40 is affected by GHSA-9f4c-93c8-jc8g (CVSS 7.2): a sandboxed iframe
can bypass the allow-popups restriction through the OpenURL navigation path.
Motionity renders no iframes, so the practical exposure was near zero, but
Electron only patches its latest three majors — on 40 there would be no fix for
the next advisory either. npm audit now reports zero vulnerabilities.

electron/main.js needed no changes: it uses only APIs stable across 40 to 43.

While verifying the packaged output, the asar turned out to carry @ffmpeg's
transitive dependencies (node-fetch, whatwg-url, regenerator-runtime and
friends). The app loads the vendored UMD bundle from src/vendor/ffmpeg/ and
requires nothing outside electron and node builtins, so build.files now excludes
node_modules wholesale instead of naming @ffmpeg — the same result without
having to track a dependency tree that is not ours.

Verified: electron-builder 26.15.3 packages electron 43.4.0, and the asar
contains the five vendored ffmpeg files and zero node_modules entries.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

package-lock.json

@@ -13,7 +13,7 @@
         "@ffmpeg/ffmpeg": "^0.11.6"
       },
       "devDependencies": {
-        "electron": "^40.0.0",
+        "electron": "^43.4.0",
         "electron-builder": "^26.0.0"
       }
     },
@@ -1468,11 +1468,10 @@
       }
     },
     "node_modules/electron": {
-      "version": "40.10.6",
-      "resolved": "https://registry.npmjs.org/electron/-/electron-40.10.6.tgz",
-      "integrity": "sha512-TGjlkOU9Lg6K4KjDbsErywCWCIDaNgLh0q+xj0nlpRoQhevI7VBIxBTtJI/V30lypyLAaXMpnP9O9jui1/qRFw==",
+      "version": "43.4.0",
+      "resolved": "https://registry.npmjs.org/electron/-/electron-43.4.0.tgz",
+      "integrity": "sha512-3qxGF0CeQbiox5oWV1JlbWGQ1VerbmDhTFqW4sJ8h7uqTHniFYPObXJcDna0DMh32et0fFyKzz0YY8lJv3t5jg==",
       "dev": true,
-      "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {
         "@electron-internal/extract-zip": "^1.0.1",
@@ -1480,7 +1479,8 @@
         "@types/node": "^24.9.0"
       },
       "bin": {
-        "electron": "cli.js"
+        "electron": "cli.js",
+        "install-electron": "install.js"
       },
       "engines": {
         "node": ">= 22.12.0"