Fix CI: sync lockfile and modernize Node.js matrix

[omgovich]

Why

CI has been red on master since "Update NPM config file formats" (5175b6b): the regenerated package-lock.json (lockfileVersion 3) was out of sync with package.json (csstype peer of goober), so npm ci failed in the Compressed Size job. Meanwhile the test matrix still ran Node 12/14, whose npm 6 can't read a v3 lockfile — it installed a drifted prettier and failed lint on untouched files.

What changed

• package-lock.json re-synced with npm install: top-level csstype is now 2.6.21 (the goober peer dep) with a nested 3.2.3 for @types/react.
• Test matrix bumped from Node 12/14 (both EOL) to 18/20/22, npm install replaced with npm ci, npm cache enabled.
• size-limit upgraded 4.10.1 → 11.2.0 (v11 is the latest major that still supports Node 18): v4 bundled with webpack 4, which crashes on Node 17+ (OpenSSL 3 removed the hash algorithms it uses); v11 uses esbuild.
• actions/checkout and actions/setup-node bumped to v4, codecov-action to v4 (the old v1 targets a Node runtime GitHub no longer ships).
• size-limit budgets adjusted to the new tool's measurements (a few entries ±10–40 B, e.g. HexColorPicker 3.12 → 3.15 KB). No library code changed in this PR.

Note

The size metric changed from gzip to brotli — modern size-limit's default. The numbers are nearly identical to the old webpack-4-gzip ones (that's why the budgets barely moved), but they aren't the same thing: size-limit now bundles with esbuild, whose output gzips ~400 B worse and brotlies back to the old figures.

How to review

package-lock.json is 99% mechanical (size-limit dependency swap); the hand-made changes are node.yml, the devDependencies/size-limit sections of package.json. Lint, tests and npm run size all pass locally on Node 22 with npm ci-installed dependencies — exactly what the new workflow runs. Not verified: tokenless codecov upload on v4 (it doesn't fail the build either way), and the Compressed Size job on this PR will stay red until merge — it builds the base branch (master), whose lockfile is still broken; it self-heals for all future PRs once this lands.