fix: externalize useSyncExternalStore shim to fix App Router crash

[tyler-reitz]

Fixes #759

Summary

Reactfire 4.2.4 and 4.2.5 crash on the client whenever a data hook renders, in any browser bundle that does not expose require. use-sync-external-store/shim (CJS) gets bundled into our ESM dist, which makes the bundler emit a dynamic require(). In a strict-ESM browser context that throws at module evaluation:

Calling `require` for "react" in an environment that doesn't expose the `require` function

4.2.3 predates the current build toolchain and is clean.

Fix

Add use-sync-external-store/shim to the Vite externals so the consumer's bundler resolves it (it is already a runtime dependency). This removes the require from our dist while keeping the shim's React 16/17 fallback, so it stays non-breaking (no peer-range change).

Verification

• Built ESM dist/index.js: require occurrences 3 to 0; clean import ... from "use-sync-external-store/shim".
• Reproduced the live crash with published 4.2.5 in two setups: a Next 16 App Router app (turbopack) and a Vite SPA (both crash client-side at module evaluation).
• Rebuilt both against this fix: Next client chunk no longer carries the throw path; the Vite app renders successfully (hook reaches status: 'success').

Patch-level, non-breaking. Fixes the regression in latest. Version bump to 4.2.6 left as a separate publish-time commit, per convention.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[tyler-reitz]

@jhuleatt flagging this for an expedited 4.2.6, since it is a regression in latest.

What: reactfire 4.2.4 and 4.2.5 crash on the client whenever a data hook renders. The bundled use-sync-external-store/shim becomes a dynamic require() that throws at module evaluation in any browser bundle without require.

Blast radius (runtime-confirmed): reproduced live in both a Next 16 App Router app (turbopack) and a Vite SPA on published 4.2.5, so it spans the two most common modern reactfire setups, not one bundler. Server prerender is unaffected (Node has require); the break is client-side. 4.2.3 is clean, so it came in with the build-tooling change around 4.2.4. No user reports yet is consistent with 4.2.4/4.2.5 being only a couple of days old.

Fix (this PR): one-line Vite externals change, non-breaking, React 16/17 fallback preserved. Verified the crash is gone (Next client chunk no longer carries the throw path; the Vite app renders status: 'success'). Armando is on for the technical review.

Since you are the manual publish path, this needs you for the 4.2.6 release once reviewed. Separately: this is the second dist-level regression to ship as a patch (after the 4.2.4 .d.ts change), so I think our release process needs a built-artifact diff gate before publish.