feat: warm-up deps — ts-reset, web-vitals, RHF devtool, query-broadcast

Four low-risk adds before the Zod 4 / drizzle-zod headliner:

- @total-typescript/ts-reset: tightens TS stdlib types globally (JSON.parse
  → unknown, fetch().json() → unknown, .filter(Boolean) narrows, Set
  literals respect typed Set targets). Caught 179 latent type errors;
  fixed all production sites (8 files) and added `any` cast escape hatch
  in test files (ESLint exemption scoped to tests/).
- web-vitals + /api/v1/internal/vitals endpoint + WebVitalsReporter
  client component: establishes Core Web Vitals baseline (LCP/INP/CLS/
  FCP/TTFB) via navigator.sendBeacon. Required before optimisation work.
- @hookform/devtools + FormDevtool wrapper: dev-only RHF state inspector,
  lazy-loaded via next/dynamic so the chunk is excluded from prod
  bundles entirely.
- @tanstack/query-broadcast-client-experimental: cross-tab cache sync
  via BroadcastChannel — wired in query-provider.tsx, 1-liner.

Audit doc updated with sections 35 + 36 (PDF stack overhaul + comprehensive
second-pass package sweep) covering ~20 package adoption candidates and
4-5 deprecation candidates.

Verified: tsc clean, vitest 1293/1293 pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/unit/comms-safety.test.ts

@@ -61,7 +61,7 @@ describe('Documenso recipient redirect — EMAIL_REDIRECT_TO', () => {
     ]);
 
     expect(fetchMock).toHaveBeenCalledOnce();
-    const callBody = JSON.parse(fetchMock.mock.calls[0]![1].body as string);
+    const callBody = JSON.parse(fetchMock.mock.calls[0]![1].body as string) as any;
     expect(callBody.recipients).toHaveLength(2);
     for (const r of callBody.recipients) {
       expect(r.email).toBe(REDIRECT_TARGET);
@@ -82,7 +82,7 @@ describe('Documenso recipient redirect — EMAIL_REDIRECT_TO', () => {
     });
 
     expect(fetchMock).toHaveBeenCalledOnce();
-    const callBody = JSON.parse(fetchMock.mock.calls[0]![1].body as string);
+    const callBody = JSON.parse(fetchMock.mock.calls[0]![1].body as string) as any;
     expect(callBody.formValues['client.primaryEmail']).toBe(REDIRECT_TARGET);
     expect(callBody.formValues['developer.email']).toBe(REDIRECT_TARGET);
     // Non-email field untouched
@@ -99,7 +99,7 @@ describe('Documenso recipient redirect — EMAIL_REDIRECT_TO', () => {
       ],
     });
 
-    const callBody = JSON.parse(fetchMock.mock.calls[0]![1].body as string);
+    const callBody = JSON.parse(fetchMock.mock.calls[0]![1].body as string) as any;
     for (const r of callBody.recipients) {
       expect(r.email).toBe(REDIRECT_TARGET);
       expect(r.name).toMatch(/\(was: .+@realclient\.com\)/);
@@ -134,7 +134,7 @@ describe('Documenso recipient redirect — EMAIL_REDIRECT_TO', () => {
       { name: 'Alice', email: 'alice@realclient.com', role: 'SIGNER', signingOrder: 1 },
     ]);
 
-    const callBody = JSON.parse(fetchMock.mock.calls[0]![1].body as string);
+    const callBody = JSON.parse(fetchMock.mock.calls[0]![1].body as string) as any;
     expect(callBody.recipients[0].email).toBe('alice@realclient.com');
   });
 });