fix(web): respect fill in Canvas hit testing

[jpenilla]

Summary

Patch Leaflet 1.9.4's Canvas hit testing so:

• unfilled circles only capture events along their circumference;
• unfilled polygons and rectangles only capture events along their edges;
• filled shapes retain their existing whole-area interaction behavior.

This fixes interactions with markers underneath circular borders and makes
Circle/Polygon behavior consistent with squaremap's existing Ellipse behavior.

Behavior changes

Marker type	Changed behavior
Circle with fill: false	Interior no longer intercepts events
Polygon with fill: false	Interior no longer intercepts events
Rectangle with fill: false	Interior no longer intercepts events

Filled shapes, ellipses, polylines, and icons are unchanged.

Integrations that intentionally need an invisible whole-area hit target can
use fill: true with fillOpacity: 0.

Implementation

Uses Bun's patched-dependency support for Leaflet 1.9.4. The patch updates
Leaflet's source and shipped ESM/UMD builds.

Leaflet 2.0 currently retains the same Canvas hit-testing behavior, so this
will need to be reevaluated when upgrading.

Verification

• Tested click and hover dispatch with overlapping Canvas markers
• Verified filled and unfilled Circle, Polygon, Rectangle, and Ellipse
• Verified Polyline behavior remains unchanged
• Verified tooltips and popups remain functional on visible strokes
• bun run format
• bun run lint
• bun run build
• bun install --frozen-lockfile

Fixes #15