chore(frontend): enforce no-explicit-any: error + add typecheck/test to CI

Step 7 of the Zod migration: lock the migration's gains in place via
lint + CI enforcement.

- eslint.config.js: `@typescript-eslint/no-explicit-any` set to error.
  Verified locally — zero violations in src/, with the only file-level
  disables being src/models/inbound.ts and src/models/outbound.ts
  (kept for DBInbound's toInbound() consumer; their migration is out
  of spec scope).

- .github/workflows/ci.yml: add Typecheck and Test steps to the
  frontend job, between Lint and Build. PRs now have to pass
  tsc --noEmit and the full vitest suite (285 tests + 172 snapshots)
  before build runs.

Migration scoreboard (vs the spec):
  Step 1 primitives + barrels         done
  Step 2 protocol leaf + DUs          done
  Step 3 pure-fn extraction           done
  Step 4 form modals -> Pattern A     done (Inbound + Outbound)
  Step 5 delete models/ files         DEFERRED (DBInbound still uses
                                      Inbound; spec marks DBInbound
                                      migration out of scope)
  Step 6 tighten .loose() / unknown   DEFERRED (invasive, separate PR)
  Step 7 lint + CI enforcement        done (this commit)

Production code paths now have no direct dependency on the legacy
Inbound or Outbound classes.

.github/workflows/ci.yml

@@ -81,6 +81,12 @@ jobs:
       - name: Lint
         run: npm run lint
         working-directory: frontend
+      - name: Typecheck
+        run: npm run typecheck
+        working-directory: frontend
+      - name: Test
+        run: npm test
+        working-directory: frontend
       - name: Build
         run: npm run build
         working-directory: frontend

frontend/eslint.config.js

@@ -29,6 +29,12 @@ export default [
         varsIgnorePattern: '^_',
         caughtErrorsIgnorePattern: '^_',
       }],
+      // Zod migration goal (Step 7): every production module is held to
+      // strict no-explicit-any. The two legacy class files at the bottom
+      // of the rule list keep their existing file-level eslint-disable
+      // until DBInbound is migrated off Inbound.toInbound() — see the
+      // migration spec Non-Goals section.
+      '@typescript-eslint/no-explicit-any': 'error',
       'no-empty': ['error', { allowEmptyCatch: true }],
       'react-hooks/set-state-in-effect': 'off',
       'react-hooks/purity': 'off',