fix: add impersonation params to resource urls

[HarshMN2345]

What does this PR do?

(Provide a description of what this PR does.)

Test Plan

(Write your test plan here. If you changed any code, please provide us with clear instructions on how you verified your changes work.)

Related PRs and Issues

(If this PR is related to any other PR or resolves any issue or related to any issue link all related PR and issues here.)

Have you read the Contributing Guidelines on issues?

(Write your answer here.)

[greptile-apps]

Greptile Summary

This PR propagates impersonation query parameters to resource URLs (file previews, downloads, invoice links) across storage, functions, sites, and billing components by introducing createImpersonatedResourceUrl / impersonatedResourceUrl in src/lib/appwrite/impersonation.ts. It also includes a bun.lock / package.json dependency refresh and CodeMirror 6.43 type-compatibility fixes in the document editor.

• Impersonation URL helper (impersonation.ts): adds createImpersonatedResourceUrl to append impersonateUserId (and arbitrary query params) to SDK-generated resource URLs, plus a derived store wrapper impersonatedResourceUrl used reactively in Svelte components.
• Callsite migration (11 files): replaces raw template-string URL construction and manual + '&mode=admin' concatenation with the new helper across storage, functions, sites, and billing; +page.ts redirect handlers for invoice download/view are similarly updated.
• CodeMirror compatibility (view.svelte): wraps foldAll/unfoldAll in typed command stubs and adds type casts to resolve API-signature changes in the updated package versions.

Confidence Score: 5/5

The change is safe to merge; the impersonation helper is correctly gated behind the browser check in all reachable paths, and the callsite migrations are mechanical replacements of existing URL construction logic.

All findings are minor code-quality observations. The URL serialization inconsistency in createImpersonatedResourceUrl cannot currently be triggered because readImpersonationTargetUserId() always returns null in non-browser contexts. The as never casts in view.svelte are a stylistic concern introduced alongside the CodeMirror version bump and do not affect runtime behavior.

No files require special attention. impersonation.ts has a latent serialization inconsistency worth tidying but it does not affect any live code path.

Important Files Changed

Filename	Overview
src/lib/appwrite/impersonation.ts	New impersonation utility: provides createImpersonatedResourceUrl and the impersonatedResourceUrl derived store. Has a latent serialization inconsistency where the non-browser path-stripping logic is not applied on the impersonation code path.
src/routes/(console)/project-[region]-[project]/databases/database-[database]/collection-[collection]/(components)/editor/view.svelte	CodeMirror 6.43 compatibility fixes: wraps foldAll/unfoldAll in typed command stubs and adds as never casts to satisfy new API types; as never is overly broad type suppression.
src/lib/components/filePicker.svelte	Replaces manual + '&mode=admin' string concatenation in getPreview with $impersonatedResourceUrl(..., { mode: 'admin' }) — cleaner and consistent.
src/routes/(console)/organization-[organization]/invoices/[invoiceId]/download/+page.ts	Replaces raw URL string with createImpersonatedResourceUrl for invoice download redirect; absolute URL so path-stripping logic is not involved.
src/routes/(console)/project-[region]-[project]/functions/function-[function]/store.ts	Switches getOutputDownload and getSourceDownload to use createImpersonatedResourceUrl with { mode: 'admin' }, matching storage file pattern.

_{Reviews (2): Last reviewed commit: "fix: override vulnerable devalue version" | Re-trigger Greptile}