chore(ci/build): typecheck gate, npm ci, backend CI, dep+vuln fixes, hygiene

Audit remediation (build/supply-chain/quality):
- Add `@pezkuwi/api-augment` import in main.tsx -> tsc errors 416->328 (Codec-typed
  on-chain reads now augmented); add `typecheck` script + a non-blocking Typecheck CI
  step (flip to blocking once errors reach 0).
- CI: `npm install` -> `npm ci` (lockfile enforced) in web + security-audit jobs; add a
  Backend Indexer job (npm ci + node --check + non-blocking high/critical audit). No
  live tests run in CI (they need a live chain) — a mockable CI test subset is a
  follow-up.
- Vulns: bump dompurify ^3.4.12 + postcss ^8.5.23 (web prod highs cleared; only the
  react-router v7 open-redirect remains, deferred as a breaking major); backend tar
  ^7.5.22 + ws ^8.21.1 (clears the critical tar advisory). Lockfiles regenerated.
- Prod build now drops console/debugger (vite esbuild.drop); NotificationBell realtime
  subscription now returns cleanup + uses a per-user channel (fixes leak); ProfileSettings
  language codes aligned to i18n config (ku-kurmanji/ku-sorani).
- Root package.json sdk-ui path env-driven (${SDK_UI_DIR}); generate-docs rustup path
  resolved dynamically; Docker image license label MIT (matches LICENSE). Removed scratch
  files (mimari.txt, _scratch_credit_serok.mjs).

.github/workflows/quality-gate.yml

@@ -58,12 +58,20 @@ jobs:
 
       - name: Install dependencies
         working-directory: ./web
-        run: npm install
+        run: npm ci
 
       - name: Run Linter
         working-directory: ./web
         run: npm run lint
 
+      # Typecheck gate. Currently non-blocking (continue-on-error) because the
+      # existing codebase still has pre-existing type errors. Once the count
+      # reaches zero, remove `continue-on-error` to make this a hard merge block.
+      - name: Typecheck
+        working-directory: ./web
+        continue-on-error: true
+        run: npm run typecheck
+
       - name: Run Tests
         working-directory: ./web
         run: npm run test
@@ -85,6 +93,48 @@ jobs:
           name: web-dist
           path: web/dist/
 
+  # ========================================
+  # BACKEND - INDEXER SERVICE (lint/smoke/audit)
+  # No build step exists (plain ESM node service); we lockfile-enforce install,
+  # syntax-check the entry point, and audit. The audit is currently non-blocking
+  # because the express@5 + sqlite3(node-gyp) trees carry transitive advisories
+  # that need a broader dependency upgrade; flip continue-on-error off once the
+  # tree is clean.
+  # ========================================
+  backend:
+    name: Backend Indexer
+    runs-on: pwap-runner
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Cache npm dependencies
+        uses: actions/cache@v4
+        with:
+          path: backend/node_modules
+          key: ${{ runner.os }}-backend-${{ hashFiles('backend/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-backend-
+
+      - name: Install dependencies
+        working-directory: ./backend
+        run: npm ci
+
+      - name: Syntax check (entry point)
+        working-directory: ./backend
+        run: node --check src/index.js
+
+      - name: npm audit (high + critical, production deps)
+        working-directory: ./backend
+        continue-on-error: true
+        run: npm audit --audit-level=high --omit=dev
+
   # ========================================
   # BUILD & PUSH DOCKER IMAGE TO GHCR
   # Immutable artifact for audit + rollback (vs ephemeral GHA artifact).
@@ -631,7 +681,7 @@ jobs:
       - name: Web — npm audit (high + critical, production deps only)
         working-directory: ./web
         run: |
-          npm install
+          npm ci
           # Audit only production dependencies. Build tooling (vite, esbuild,
           # vite-plugin-node-polyfills → elliptic, etc.) ships to no user, and
           # advisories on those dev deps kept blocking production deploys.