fix(demo): bump adapter-cloudflare to v7 to resolve esbuild vulnerability

Upgrade @sveltejs/adapter-cloudflare from v6 to v7, which drops the
bundled esbuild@0.24.2 (CVE with medium severity). Add wrangler as
explicit devDependency as required by v7.

cookie@0.6.0 (low severity) remains — pinned by @sveltejs/kit with
no upstream fix available yet.

Author: Anton Stefer