feat: warm-up deps — ts-reset, web-vitals, RHF devtool, query-broadcast

Four low-risk adds before the Zod 4 / drizzle-zod headliner:

- @total-typescript/ts-reset: tightens TS stdlib types globally (JSON.parse
  → unknown, fetch().json() → unknown, .filter(Boolean) narrows, Set
  literals respect typed Set targets). Caught 179 latent type errors;
  fixed all production sites (8 files) and added `any` cast escape hatch
  in test files (ESLint exemption scoped to tests/).
- web-vitals + /api/v1/internal/vitals endpoint + WebVitalsReporter
  client component: establishes Core Web Vitals baseline (LCP/INP/CLS/
  FCP/TTFB) via navigator.sendBeacon. Required before optimisation work.
- @hookform/devtools + FormDevtool wrapper: dev-only RHF state inspector,
  lazy-loaded via next/dynamic so the chunk is excluded from prod
  bundles entirely.
- @tanstack/query-broadcast-client-experimental: cross-tab cache sync
  via BroadcastChannel — wired in query-provider.tsx, 1-liner.

Audit doc updated with sections 35 + 36 (PDF stack overhaul + comprehensive
second-pass package sweep) covering ~20 package adoption candidates and
4-5 deprecation candidates.

Verified: tsc clean, vitest 1293/1293 pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/unit/encryption.test.ts

@@ -26,7 +26,7 @@ describe('encrypt / decrypt', () => {
   });
 
   it('tampered data field throws on decrypt', () => {
-    const stored = JSON.parse(encrypt('tamper me'));
+    const stored = JSON.parse(encrypt('tamper me')) as any;
     // Flip the first hex byte of data
     const originalByte = stored.data.slice(0, 2);
     const flipped = originalByte === 'ff' ? '00' : 'ff';
@@ -36,7 +36,7 @@ describe('encrypt / decrypt', () => {
   });
 
   it('tampered auth tag throws on decrypt', () => {
-    const stored = JSON.parse(encrypt('tamper tag'));
+    const stored = JSON.parse(encrypt('tamper tag')) as any;
     const originalByte = stored.tag.slice(0, 2);
     const flipped = originalByte === 'ff' ? '00' : 'ff';
     stored.tag = flipped + stored.tag.slice(2);