feat: warm-up deps — ts-reset, web-vitals, RHF devtool, query-broadcast

Four low-risk adds before the Zod 4 / drizzle-zod headliner:

- @total-typescript/ts-reset: tightens TS stdlib types globally (JSON.parse
  → unknown, fetch().json() → unknown, .filter(Boolean) narrows, Set
  literals respect typed Set targets). Caught 179 latent type errors;
  fixed all production sites (8 files) and added `any` cast escape hatch
  in test files (ESLint exemption scoped to tests/).
- web-vitals + /api/v1/internal/vitals endpoint + WebVitalsReporter
  client component: establishes Core Web Vitals baseline (LCP/INP/CLS/
  FCP/TTFB) via navigator.sendBeacon. Required before optimisation work.
- @hookform/devtools + FormDevtool wrapper: dev-only RHF state inspector,
  lazy-loaded via next/dynamic so the chunk is excluded from prod
  bundles entirely.
- @tanstack/query-broadcast-client-experimental: cross-tab cache sync
  via BroadcastChannel — wired in query-provider.tsx, 1-liner.

Audit doc updated with sections 35 + 36 (PDF stack overhaul + comprehensive
second-pass package sweep) covering ~20 package adoption candidates and
4-5 deprecation candidates.

Verified: tsc clean, vitest 1293/1293 pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/api/client.ts

@@ -73,7 +73,14 @@ export async function apiFetch<T = unknown>(url: string, opts: ApiFetchOptions =
   });
 
   if (!res.ok) {
-    const error = await res.json().catch(() => ({ error: res.statusText }));
+    const error = (await res.json().catch(() => ({ error: res.statusText }))) as {
+      error?: string;
+      message?: string;
+      code?: string;
+      details?: unknown;
+      requestId?: string;
+      retryAfter?: number;
+    };
     // Surface the request id so toasts can display "Error ID: …" and
     // the user can copy it to a support ticket. Server-side wrappers
     // always set X-Request-Id, even on early-return 401/403 paths.

src/lib/services/client-archive-dossier.service.ts

@@ -33,7 +33,7 @@ import type { PipelineStage } from '@/lib/constants';
  *   bulk-archive UI prompts the operator to confirm individually + supply
  *   a reason for these clients.
  */
-export const HIGH_STAKES_STAGES: ReadonlySet<PipelineStage> = new Set([
+export const HIGH_STAKES_STAGES: ReadonlySet<PipelineStage> = new Set<PipelineStage>([
   'deposit_10pct',
   'contract_sent',
   'contract_signed',

src/lib/services/currency.ts

@@ -30,8 +30,8 @@ export async function refreshRates(): Promise<void> {
       throw new CodedError('INTERNAL', {
         internalMessage: `Frankfurter API error: ${res.status}`,
       });
-    const data = await res.json();
-    const rates = data.rates as Record<string, number>;
+    const data = (await res.json()) as { rates: Record<string, number> };
+    const rates = data.rates;
 
     for (const [currency, rate] of Object.entries(rates)) {
       await db

src/lib/services/inquiry-notifications.service.ts

@@ -105,7 +105,7 @@ export async function sendInquiryNotifications(params: InquiryNotificationParams
   try {
     const recipientsSetting = await getSetting('inquiry_notification_recipients', portId);
     const externalEmails: string[] = Array.isArray(recipientsSetting?.value)
-      ? recipientsSetting.value
+      ? recipientsSetting.value.filter((v): v is string => typeof v === 'string')
       : [];
 
     if (externalEmails.length > 0) {