deps(node): migrate the Node binding to napi-rs 3 (#347)

Bumps napi 2.16 -> 3.9 and napi-derive 2.16 -> 3.5 (cargo) and @napi-rs/cli
2.18 -> 3.7 (npm). napi 3's derive macros emit #[allow(unsafe_code)], which the
workspace-wide forbid(unsafe_code) cannot permit, so the Node crate gets its own
[lints] block mirroring the workspace with unsafe_code relaxed to deny — forbid
stays in force for every other crate. The CLI-3-regenerated index.d.ts / index.js
keep the identical 626-symbol public API (only the codegen format changed). MSRV
stays 1.88 (napi 3.9 requires exactly that); ureq is intentionally left at 2.x.
Verified locally: cargo clippy clean, 1108/1108 Node tests pass.

Supersedes the napi half of the cargo group bump and the @napi-rs/cli npm bump.

bindings/node/Cargo.toml

@@ -20,14 +20,35 @@ publish = false
 [lib]
 crate-type = ["cdylib"]
 
-[lints]
-workspace = true
+# Mirrors [workspace.lints] (the source of truth) EXCEPT `unsafe_code`, which is
+# relaxed from the workspace `forbid` to `deny`: the napi-rs 3 derive macros emit
+# `#[allow(unsafe_code)]`, which `forbid` cannot permit. `deny` still fails the
+# build on any unguarded unsafe in our own code. Keep this list in sync with the
+# workspace if its lints change.
+[lints.rust]
+unsafe_code = "deny"
+missing_debug_implementations = "warn"
+unreachable_pub = "warn"
+unused_must_use = "deny"
+
+[lints.clippy]
+all = { level = "warn", priority = -1 }
+pedantic = { level = "warn", priority = -1 }
+module_name_repetitions = "allow"
+must_use_candidate = "allow"
+missing_errors_doc = "allow"
+missing_panics_doc = "allow"
+cast_precision_loss = "allow"
+cast_possible_truncation = "allow"
+cast_sign_loss = "allow"
+similar_names = "allow"
+float_cmp = "allow"
 
 [dependencies]
 wickra-core = { workspace = true }
 wickra-data = { workspace = true, features = ["live-binance"] }
-napi = { version = "2.16", features = ["napi8"] }
-napi-derive = "2.16"
+napi = { version = "3.9", features = ["napi8"] }
+napi-derive = "3.5"
 # Drives the async Binance feed behind the blocking poll.
 tokio = { version = "1", features = ["rt", "net", "time"] }
 

bindings/node/package.json

@@ -44,7 +44,7 @@
     }
   },
   "engines": {
-    "node": ">= 20"
+    "node": ">= 22"
   },
   "optionalDependencies": {
     "wickra-linux-x64-gnu": "0.9.7",
@@ -64,6 +64,6 @@
     "bench": "node benchmarks/throughput.js"
   },
   "devDependencies": {
-    "@napi-rs/cli": "^2.18.0"
+    "@napi-rs/cli": "^3.7.2"
   }
 }