chore(frontend): enforce no-explicit-any: error + add typecheck/test to CI

Step 7 of the Zod migration: lock the migration's gains in place via
lint + CI enforcement.

- eslint.config.js: `@typescript-eslint/no-explicit-any` set to error.
  Verified locally — zero violations in src/, with the only file-level
  disables being src/models/inbound.ts and src/models/outbound.ts
  (kept for DBInbound's toInbound() consumer; their migration is out
  of spec scope).

- .github/workflows/ci.yml: add Typecheck and Test steps to the
  frontend job, between Lint and Build. PRs now have to pass
  tsc --noEmit and the full vitest suite (285 tests + 172 snapshots)
  before build runs.

Migration scoreboard (vs the spec):
  Step 1 primitives + barrels         done
  Step 2 protocol leaf + DUs          done
  Step 3 pure-fn extraction           done
  Step 4 form modals -> Pattern A     done (Inbound + Outbound)
  Step 5 delete models/ files         DEFERRED (DBInbound still uses
                                      Inbound; spec marks DBInbound
                                      migration out of scope)
  Step 6 tighten .loose() / unknown   DEFERRED (invasive, separate PR)
  Step 7 lint + CI enforcement        done (this commit)

Production code paths now have no direct dependency on the legacy
Inbound or Outbound classes.

.github/workflows/ci.yml

@@ -81,6 +81,12 @@ jobs:
       - name: Lint
         run: npm run lint
         working-directory: frontend
+      - name: Typecheck
+        run: npm run typecheck
+        working-directory: frontend
+      - name: Test
+        run: npm test
+        working-directory: frontend
       - name: Build
         run: npm run build
         working-directory: frontend