web: make the typecheck a real gate, held to a ratchet (#54)

The typecheck ran with continue-on-error, so it could not fail, and it did
not see much of the code it was meant to check: shared/ resolved none of its
imports (61 TS2307), which hid every type error behind them.

- tsconfig.app.json resolves packages that shared/ imports from web's
  node_modules (types first), and @pezkuwi/utils subpaths as vite does.
  Unresolved imports: 61 -> 0. The real errors behind them are now visible:
  353 in total, most in production code with little test cover.
- Fixing those in one change would be a large edit to that code. Instead
  ops/typecheck-ratchet.py records them per file and error code in
  ops/typecheck-baseline.txt and fails when any file gains one, or when
  errors were fixed without lowering the baseline in the same change.
  Line numbers are not part of the signature, so unrelated edits do not
  trip it. Checked: a new error in App.tsx fails (exit 1); an unlowered
  baseline fails (exit 1); the current tree passes.

The CI step runs the ratchet instead of the non-blocking typecheck.

.github/workflows/quality-gate.yml

@@ -72,13 +72,11 @@ jobs:
         working-directory: ./web
         run: npm run lint
 
-      # Typecheck gate. Currently non-blocking (continue-on-error) because the
-      # existing codebase still has pre-existing type errors. Once the count
-      # reaches zero, remove `continue-on-error` to make this a hard merge block.
-      - name: Typecheck
-        working-directory: ./web
-        continue-on-error: true
-        run: npm run typecheck
+      # Typecheck gate, held to a ratchet: the type errors that predate the gate
+      # are recorded in ops/typecheck-baseline.txt, and this fails when any file
+      # gains one, or when errors were fixed without lowering the baseline.
+      - name: Typecheck (ratchet)
+        run: python3 ops/typecheck-ratchet.py
 
       - name: Run Tests
         working-directory: ./web