feat: require a zero-error product typecheck and a test type-debt ratchet

Adds tsconfig.json (strict) over product code, fixes its remaining 90
diagnostics (type-only, interface corrections, and explicit narrowing),
and adds a typecheck job to the required free-tests aggregate running
bun run typecheck, the test-code ratchet (identity -> count baseline, fails
on new, repeated, or unlocked fixed diagnostics), and the lib/cso format
check. Reuses fixes from #2447 where they still applied.

make-pdf/src/html-to-docx.d.ts

@@ -0,0 +1,7 @@
+declare module 'html-to-docx' {
+  export default function HTMLtoDOCX(
+    htmlString: string,
+    headerHTMLString: string | null,
+    documentOptions?: { title?: string; creator?: string },
+  ): Promise<Uint8Array | Blob>;
+}