chore(ci/build): typecheck gate, npm ci, backend CI, dep+vuln fixes, hygiene

Audit remediation (build/supply-chain/quality):
- Add `@pezkuwi/api-augment` import in main.tsx -> tsc errors 416->328 (Codec-typed
  on-chain reads now augmented); add `typecheck` script + a non-blocking Typecheck CI
  step (flip to blocking once errors reach 0).
- CI: `npm install` -> `npm ci` (lockfile enforced) in web + security-audit jobs; add a
  Backend Indexer job (npm ci + node --check + non-blocking high/critical audit). No
  live tests run in CI (they need a live chain) — a mockable CI test subset is a
  follow-up.
- Vulns: bump dompurify ^3.4.12 + postcss ^8.5.23 (web prod highs cleared; only the
  react-router v7 open-redirect remains, deferred as a breaking major); backend tar
  ^7.5.22 + ws ^8.21.1 (clears the critical tar advisory). Lockfiles regenerated.
- Prod build now drops console/debugger (vite esbuild.drop); NotificationBell realtime
  subscription now returns cleanup + uses a per-user channel (fixes leak); ProfileSettings
  language codes aligned to i18n config (ku-kurmanji/ku-sorani).
- Root package.json sdk-ui path env-driven (${SDK_UI_DIR}); generate-docs rustup path
  resolved dynamically; Docker image license label MIT (matches LICENSE). Removed scratch
  files (mimari.txt, _scratch_credit_serok.mjs).

web/package.json

@@ -8,6 +8,7 @@
     "dev": "cp .env.development .env && vite",
     "prebuild": "node generate-docs-structure.cjs",
     "build": "vite build",
+    "typecheck": "tsc --noEmit -p tsconfig.app.json",
     "build:telegram": "vite build --config vite.config.telegram.ts",
     "build:dev": "cp .env.development .env && vite build",
     "build:alfa": "cp .env.alfa .env && vite build",
@@ -70,7 +71,7 @@
     "clsx": "^2.1.1",
     "cmdk": "^1.0.0",
     "date-fns": "^3.6.0",
-    "dompurify": "^3.3.1",
+    "dompurify": "^3.4.12",
     "embla-carousel-react": "^8.3.0",
     "highlight.js": "^11.9.0",
     "i18next": "^23.7.6",
@@ -142,7 +143,7 @@
     "globals": "^15.15.0",
     "husky": "^9.1.7",
     "jsdom": "^27.2.0",
-    "postcss": "^8.4.47",
+    "postcss": "^8.5.23",
     "tailwindcss": "^3.4.11",
     "typescript": "^5.5.3",
     "typescript-eslint": "^8.0.1",