- Bump eslint, eslint-plugin-n (v18 ships ESM default export, so
  eslint.config.js now unwraps `.default`), globals, prettier, and
  release-it to latest. `npm audit fix` clears transitive lodash and
  picomatch advisories.
- Move Prettier config from .prettierrc.json to prettier.config.js so
  the options can carry a JSDoc type hint for editor autocomplete.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

`timingSafeEqual` throws `RangeError` when the buffers differ in
length, so any signature that didn't base64-decode to 32 bytes was
leaking out of the verifier instead of surfacing as the documented
`TruepicWebhookVerifierError`. Pre-empt the length check so the
public contract holds.

Also drop the redundant base64 round-trip in favor of `digest()`
returning raw bytes directly.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

- Reject headers with anything other than two non-empty
  comma-separated parts; the previous parser silently dropped
  anything past the second comma.
- Split each `k=v` pair on the *first* `=` only. Base64 signatures
  end with `=` padding, so splitting on every `=` was silently
  truncating the trailing padding from the signature value. Worked
  in practice because Node's base64 decoder is lenient about
  padding, but the parser was dropping bytes from its input.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

The happy path was previously bypassing the timestamp check with
`leewayMinutes: 999999999` and the lone "not within allowed window"
test relied on the fixture being years in the past, which only
worked while real time kept marching forward. Replace with explicit
boundary cases pinned to a fixed clock via `t.mock.timers`:

- Happy path now uses the function's default leeway with the clock
  pinned to the moment the request was sent.
- Four new cases cover exactly-at-boundary (passes) and one ms past
  the boundary (throws), in both the future and past directions.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>