chore(ci/build): typecheck gate, npm ci, backend CI, dep+vuln fixes, hygiene

Audit remediation (build/supply-chain/quality):
- Add `@pezkuwi/api-augment` import in main.tsx -> tsc errors 416->328 (Codec-typed
  on-chain reads now augmented); add `typecheck` script + a non-blocking Typecheck CI
  step (flip to blocking once errors reach 0).
- CI: `npm install` -> `npm ci` (lockfile enforced) in web + security-audit jobs; add a
  Backend Indexer job (npm ci + node --check + non-blocking high/critical audit). No
  live tests run in CI (they need a live chain) — a mockable CI test subset is a
  follow-up.
- Vulns: bump dompurify ^3.4.12 + postcss ^8.5.23 (web prod highs cleared; only the
  react-router v7 open-redirect remains, deferred as a breaking major); backend tar
  ^7.5.22 + ws ^8.21.1 (clears the critical tar advisory). Lockfiles regenerated.
- Prod build now drops console/debugger (vite esbuild.drop); NotificationBell realtime
  subscription now returns cleanup + uses a per-user channel (fixes leak); ProfileSettings
  language codes aligned to i18n config (ku-kurmanji/ku-sorani).
- Root package.json sdk-ui path env-driven (${SDK_UI_DIR}); generate-docs rustup path
  resolved dynamically; Docker image license label MIT (matches LICENSE). Removed scratch
  files (mimari.txt, _scratch_credit_serok.mjs).

web/generate-docs-structure.cjs

@@ -17,8 +17,23 @@ const rustdocDestPath = path.join(publicPath, 'sdk_docs'); // Destination for BU
 const structureOutputPath = path.join(publicPath, 'docs-structure.json');
 const rustdocBuildOutputPath = path.join(pezkuwiSdkRoot, 'target', 'doc'); // Output of cargo doc
 
-// Absolute path to rustup (used to build rustdoc)
-const rustupPath = '/home/mamostehp/.cargo/bin/rustup';
+// Path to rustup (used to build rustdoc). Resolve dynamically instead of
+// hardcoding a per-machine absolute path: prefer $RUSTUP_PATH, then whatever
+// is on PATH, then the conventional ~/.cargo/bin/rustup, then bare 'rustup'.
+function resolveRustupPath() {
+    if (process.env.RUSTUP_PATH) return process.env.RUSTUP_PATH;
+    try {
+        const which = spawnSync('bash', ['-lc', 'command -v rustup'], { encoding: 'utf8' });
+        if (which.status === 0 && which.stdout && which.stdout.trim()) {
+            return which.stdout.trim();
+        }
+    } catch { /* fall through */ }
+    const home = process.env.HOME || require('os').homedir();
+    const cargoRustup = path.join(home, '.cargo', 'bin', 'rustup');
+    if (fs.existsSync(cargoRustup)) return cargoRustup;
+    return 'rustup';
+}
+const rustupPath = resolveRustupPath();
 
 // Path to the rebranding script (now .cjs)
 const rebrandScriptPath = path.join(__dirname, 'rebrand-rustdoc.cjs');