chore(ci/build): typecheck gate, npm ci, backend CI, dep+vuln fixes, hygiene

Audit remediation (build/supply-chain/quality):
- Add `@pezkuwi/api-augment` import in main.tsx -> tsc errors 416->328 (Codec-typed
  on-chain reads now augmented); add `typecheck` script + a non-blocking Typecheck CI
  step (flip to blocking once errors reach 0).
- CI: `npm install` -> `npm ci` (lockfile enforced) in web + security-audit jobs; add a
  Backend Indexer job (npm ci + node --check + non-blocking high/critical audit). No
  live tests run in CI (they need a live chain) — a mockable CI test subset is a
  follow-up.
- Vulns: bump dompurify ^3.4.12 + postcss ^8.5.23 (web prod highs cleared; only the
  react-router v7 open-redirect remains, deferred as a breaking major); backend tar
  ^7.5.22 + ws ^8.21.1 (clears the critical tar advisory). Lockfiles regenerated.
- Prod build now drops console/debugger (vite esbuild.drop); NotificationBell realtime
  subscription now returns cleanup + uses a per-user channel (fixes leak); ProfileSettings
  language codes aligned to i18n config (ku-kurmanji/ku-sorani).
- Root package.json sdk-ui path env-driven (${SDK_UI_DIR}); generate-docs rustup path
  resolved dynamically; Docker image license label MIT (matches LICENSE). Removed scratch
  files (mimari.txt, _scratch_credit_serok.mjs).

web/src/components/notifications/NotificationBell.tsx

@@ -29,11 +29,14 @@ export default function NotificationBell() {
   const [open, setOpen] = useState(false);
 
   useEffect(() => {
-    if (user) {
-      loadNotifications();
+    if (!user) return;
 
-      subscribeToNotifications();
-    }
+    loadNotifications();
+    // Return the unsubscribe callback so the realtime channel is torn down
+    // on unmount / when the user changes — otherwise channels leak and
+    // setState fires after unmount.
+    const unsubscribe = subscribeToNotifications();
+    return unsubscribe;
   // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [user]);
 
@@ -55,7 +58,7 @@ export default function NotificationBell() {
 
   const subscribeToNotifications = () => {
     const channel = supabase
-      .channel('notifications')
+      .channel(`notifications-${user?.id}`)
       .on(
         'postgres_changes',
         {

web/src/main.tsx

@@ -26,6 +26,10 @@ if (typeof window !== 'undefined' && import.meta.env.PROD) {
   };
 }
 
+// Augment @pezkuwi/api types so api.query/tx/rpc return typed values
+// instead of the generic `Codec`. Must be imported before any api usage.
+import '@pezkuwi/api-augment';
+
 import { createRoot } from 'react-dom/client'
 import App from './App.tsx'
 import './index.css'

web/src/pages/ProfileSettings.tsx

@@ -398,8 +398,8 @@ export default function ProfileSettings() {
                     <SelectItem value="en">English</SelectItem>
                     <SelectItem value="tr">Türkçe</SelectItem>
                     <SelectItem value="ar">العربية</SelectItem>
-                    <SelectItem value="kmr">Kurdî</SelectItem>
-                    <SelectItem value="ckb">کوردی</SelectItem>
+                    <SelectItem value="ku-kurmanji">Kurdî (Kurmancî)</SelectItem>
+                    <SelectItem value="ku-sorani">کوردی (سۆرانی)</SelectItem>
                     <SelectItem value="fa">فارسی</SelectItem>
                   </SelectContent>
                 </Select>