feat: warm-up deps — ts-reset, web-vitals, RHF devtool, query-broadcast

Four low-risk adds before the Zod 4 / drizzle-zod headliner:

- @total-typescript/ts-reset: tightens TS stdlib types globally (JSON.parse
  → unknown, fetch().json() → unknown, .filter(Boolean) narrows, Set
  literals respect typed Set targets). Caught 179 latent type errors;
  fixed all production sites (8 files) and added `any` cast escape hatch
  in test files (ESLint exemption scoped to tests/).
- web-vitals + /api/v1/internal/vitals endpoint + WebVitalsReporter
  client component: establishes Core Web Vitals baseline (LCP/INP/CLS/
  FCP/TTFB) via navigator.sendBeacon. Required before optimisation work.
- @hookform/devtools + FormDevtool wrapper: dev-only RHF state inspector,
  lazy-loaded via next/dynamic so the chunk is excluded from prod
  bundles entirely.
- @tanstack/query-broadcast-client-experimental: cross-tab cache sync
  via BroadcastChannel — wired in query-provider.tsx, 1-liner.

Audit doc updated with sections 35 + 36 (PDF stack overhaul + comprehensive
second-pass package sweep) covering ~20 package adoption candidates and
4-5 deprecation candidates.

Verified: tsc clean, vitest 1293/1293 pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/components/interests/external-eoi-upload-dialog.tsx

@@ -48,7 +48,9 @@ export function ExternalEoiUploadDialog({ open, onOpenChange, interestId, onSucc
         credentials: 'include',
       });
       if (!res.ok) {
-        const err = await res.json().catch(() => ({ error: 'Upload failed' }));
+        const err = (await res.json().catch(() => ({ error: 'Upload failed' }))) as {
+          error?: string;
+        };
         throw new Error(err.error ?? 'Upload failed');
       }
       return res.json();

src/components/shared/filter-bar.tsx

@@ -233,10 +233,12 @@ function FilterField({
                     id={`${definition.key}-${opt.value}`}
                     checked={selected}
                     onCheckedChange={(checked) => {
-                      const current = Array.isArray(value) ? value : [];
+                      const current: string[] = Array.isArray(value)
+                        ? value.filter((v): v is string => typeof v === 'string')
+                        : [];
                       const next = checked
                         ? [...current, opt.value]
-                        : current.filter((v: string) => v !== opt.value);
+                        : current.filter((v) => v !== opt.value);
                       onChange(next.length > 0 ? next : undefined);
                     }}
                   />

src/components/shared/form-devtool.tsx

@@ -0,0 +1,32 @@
+'use client';
+
+import dynamic from 'next/dynamic';
+import type { Control, FieldValues } from 'react-hook-form';
+
+// Lazy-load @hookform/devtools only when actually rendered. The
+// `process.env.NODE_ENV` guard below ensures we never hit this path in
+// production, so Next.js' code splitter keeps the devtools chunk out of
+// the prod bundle entirely.
+const DevTool = dynamic(() => import('@hookform/devtools').then((m) => ({ default: m.DevTool })), {
+  ssr: false,
+});
+
+/**
+ * Floating react-hook-form state inspector. Shows live values, errors,
+ * touched/dirty state. Rendered only in development.
+ *
+ * Usage in any form component:
+ *
+ *   const form = useForm({ resolver: zodResolver(schema) });
+ *   ...
+ *   <form onSubmit={form.handleSubmit(onSubmit)}>
+ *     <FormDevtool control={form.control} />
+ *     {fields}
+ *   </form>
+ */
+export function FormDevtool<T extends FieldValues>({ control }: { control: Control<T> }) {
+  if (process.env.NODE_ENV !== 'development') return null;
+  // Cast: @hookform/devtools types Control as the v6 shape; ours is v7+.
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  return <DevTool control={control as any} placement="bottom-right" />;
+}

src/components/shared/notes-list.tsx

@@ -56,7 +56,7 @@ const SELF_SOURCE: Record<NotesEntityType, NoteSource | null> = {
   residential_interests: null,
 };
 
-const AGGREGATABLE: ReadonlySet<NotesEntityType> = new Set([
+const AGGREGATABLE: ReadonlySet<NotesEntityType> = new Set<NotesEntityType>([
   'clients',
   'yachts',
   'companies',

src/components/shared/web-vitals-reporter.tsx

@@ -0,0 +1,56 @@
+'use client';
+
+import { useEffect } from 'react';
+import { onLCP, onINP, onCLS, onFCP, onTTFB, type Metric } from 'web-vitals';
+
+const VITALS_ENDPOINT = '/api/v1/internal/vitals';
+
+/**
+ * Reports Core Web Vitals to the backend so we have a baseline before
+ * any perf-optimisation work. Sends via `sendBeacon` (survives unload)
+ * with a `fetch` fallback for browsers that don't support beacon.
+ *
+ * Mounted in the dashboard layout — fires once per page lifecycle for
+ * each metric. Vitals are reported when stable (LCP locked in, INP after
+ * meaningful interaction, etc.), not on every render.
+ */
+export function WebVitalsReporter() {
+  useEffect(() => {
+    function report(metric: Metric) {
+      const path = typeof window !== 'undefined' ? window.location.pathname : null;
+
+      const body = JSON.stringify({
+        name: metric.name,
+        value: metric.value,
+        rating: metric.rating,
+        id: metric.id,
+        delta: metric.delta,
+        navigationType: metric.navigationType,
+        path,
+      });
+
+      if (typeof navigator !== 'undefined' && navigator.sendBeacon) {
+        navigator.sendBeacon(VITALS_ENDPOINT, new Blob([body], { type: 'application/json' }));
+        return;
+      }
+
+      // Fallback for browsers without sendBeacon.
+      fetch(VITALS_ENDPOINT, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body,
+        keepalive: true,
+      }).catch(() => {
+        // Swallow — vitals are best-effort.
+      });
+    }
+
+    onLCP(report);
+    onINP(report);
+    onCLS(report);
+    onFCP(report);
+    onTTFB(report);
+  }, []);
+
+  return null;
+}