fix(review): restore cookie attrs + color fallback, drop stale knip entry

Code-review findings:
- donation-toast: restore path/secure/sameSite cookie attributes the
  inlined useCookie dropped (security/scope regression).
- utils/color: restore @uiw fallback so percentage-notation rgb() still
  converts (custom style-rule colors are arbitrary strings); add tests
  pinning the one real difference vs the black fallback.
- knip: drop stale npm-check-updates ignoreDependencies entry.

Claude-Session: https://claude.ai/code/session_012Bnvt1MghwHj4qQRxuQUGa

packages/utils/src/color.test.ts

@@ -26,6 +26,14 @@ describe("rgbaStringToHex", () => {
 		expect(rgbaStringToHex("#F1F5F9")).toBe("#f1f5f9");
 		expect(rgbaStringToHex("#0F172A")).toBe("#0f172a");
 	});
+
+	it("converts percentage-notation rgb via the @uiw fallback (integer parser misses it)", () => {
+		expect(rgbaStringToHex("rgb(100%, 0%, 0%)")).toBe("#ff0000");
+	});
+
+	it("returns black for formats neither parser nor @uiw understands", () => {
+		expect(rgbaStringToHex("not-a-color")).toBe("#000000");
+	});
 });
 
 describe("isDarkColor", () => {

packages/utils/src/color.ts

@@ -1,12 +1,14 @@
+import { hsvaToHex, rgbaStringToHsva } from "@uiw/color-convert";
+
 type ParsedColor = { r: number; g: number; b: number; a: number };
 
 export function rgbaStringToHex(rgba: string): string {
 	const color = parseColorString(rgba);
 	if (color) return `#${toHexComponent(color.r)}${toHexComponent(color.g)}${toHexComponent(color.b)}`;
-	// ponytail: unrecognized format → black. Callers only pass builder-picker output (hex/rgba),
-	// which parseColorString handles; named-color/hsl inputs never reach here. If a caller ever needs
-	// those, restore a real converter (e.g. @uiw/color-convert) instead of this black fallback.
-	return "#000000";
+	// Fallback: the local parser is integer-only, so percentage-notation rgb() (e.g. "rgb(100%,0%,0%)")
+	// reaches here — @uiw converts it. Everything @uiw can't parse (named colors, hsl, transparent)
+	// yields black, same as it always has. Custom style-rule colors are arbitrary strings, so keep this.
+	return hsvaToHex(rgbaStringToHsva(rgba));
 }
 
 function toHexComponent(value: number): string {