Tests, tooling and the served scripts are TypeScript (#392)

The page and the service worker were strict TypeScript; the tests, the
build, the home page's generator, the load tests, boot.js and the
directory's site.js were plain JavaScript that nothing checked. All of
it is TypeScript now, in five programs, each with its own globals, all
checked by npm run typecheck: the page (tsconfig.json, with boot.ts and
the directory's site.ts), the worker, Node's (tsconfig.tools.json: the
Node tests, the browser suite, the build, the site generator, the load
harness), and k6's (tsconfig.k6.json, with @types/k6).

Node 24 runs the .ts files by stripping their types, so they hold only
TypeScript that erases (erasableSyntaxOnly) and import each other by
.ts name; package.json says "type": "module" for it, and Dockerfile.web
moves to Node 24 to run build.mts. k6 2.3 strips its scripts' types
itself.

The browser suite's page.evaluate calls reach the page's globals; the
page's tsc run now also writes its declarations to target/page-types,
which the suite's program includes, so those calls are typed by the
page's own code rather than by hand-written copies.

boot.ts is compiled by build.mts with swc, as the worker is, and named
by the hash of what is served. The directory's build has no Node, so
site.js is compiled from site.ts and committed (node web/build.mts
--directory-script), and tests/directory-script.ts fails if they drift.

Checked: the site generator's 139 pages are byte for byte what the
JavaScript made; the page build's app.js is identical and only boot.js
(now minified) and its hash differ; contrast, page-smoke, page-unit,
native-bridge, the browser suite (96 passed, 2 skipped) and the
directory's and ipx's Rust tests pass; k6 parses each load script. The
load tests themselves did not run: they build a release binary outside
the capped builder. .agents/skills/security-audit is an installed
skill's, not ours, and is left as it is.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/architecture.md

@@ -72,8 +72,8 @@ id, and Caddy's request lines theirs. ipx also serves Prometheus metrics (`[web]
 | `web/admin.html` | The admin page's markup: server settings, accounts, the log. Sent to admins only | — |
 | `web/app.css` | The stylesheet both pages share | — |
 | `web/src/*.ts` | The page's script, one scope split across files, type-checked by `npx tsc` | — |
-| `web/build.mjs` | swc: strips the types into `app.js`/`admin.js`/`login.js`, named in the page by a hash of their contents, minifies, and writes the static site to `web/dist` | — |
-| `web/boot.js` | In `<head>`: the theme from its cookie, and an admin's link, before the first frame | — |
+| `web/build.mts` | swc: strips the types into `app.js`/`admin.js`/`login.js`, named in the page by a hash of their contents, minifies, and writes the static site to `web/dist` | — |
+| `web/boot.ts` | In `<head>`: the theme from its cookie, and an admin's link, before the first frame | — |
 | `web/Caddyfile` | `ipx-web`: serves `web/dist`, asks ipx before serving a page, passes `/api` and `/media` to ipx | — |
 
 The page is a separate image, `ipx-web` (`Dockerfile.web`, #203), so **editing `web/` needs
@@ -213,10 +213,10 @@ before they reach the page.
 
 ```sh
 cargo test                # parsing, filters, retention, schedules, SQL, per-user isolation
-node tests/page-smoke.js  # the page script loads and every selector it wires at load exists
-node tests/native-bridge.js  # the page hands playback to a native shell
+node tests/page-smoke.ts  # the page script loads and every selector it wires at load exists
+node tests/native-bridge.ts  # the page hands playback to a native shell
 npx playwright test       # a real browser against a real daemon on fixture feeds
-node tests/load/run.js    # k6: many people at once against a daemon with 1,500 generated feeds
+node tests/load/run.ts    # k6: many people at once against a daemon with 1,500 generated feeds
 ```
 
 The Rust tests cannot see a wrong selector, a handler that runs and does nothing, or a page that

docs/signals.md

@@ -364,7 +364,7 @@ erDiagram
 - `signals` and `signal_verdicts` are created from their entities like every table
   (`crates/ipx/src/entity.rs`). `users.typesafe_key`, `signals.description` and `signals.icon`
   were added to existing tables, so `create_missing` adds each column when it is missing.
-- The icons are files of ipx-web's, not the database's: `web/build.mjs` copies Font Awesome Free's
+- The icons are files of ipx-web's, not the database's: `web/build.mts` copies Font Awesome Free's
   SVGs to `/icons/<style>/<name>.svg`, kept a day, and writes `/icons/index.json`, names, labels
   and search terms, about 90 KB compressed, named by its hash and fetched when the picker first
   opens. A Signal's tile draws its one file as a CSS mask, so it takes the theme's colour.
@@ -406,7 +406,7 @@ erDiagram
 - `cargo test -p ipx`: the request's shape and the threshold (`signals::tests`), and the queue,
   verdicts, ownership, unread counts and new keywords (`db::tests::a_signal_shows_what_jev_said_fits_and_only_to_its_owner`),
   on SQLite and Postgres both.
-- `node --test tests/page-unit.js`: a Signal's place id and its list's address.
+- `node --test tests/page-unit.ts`: a Signal's place id and its list's address.
 - `npx playwright test -g Signal`: makes a Signal from the folder's +, and checks that the matching
   item shows and that reading it reads it in its feed and clears the badge. TypeSafe is stood in for
   by the fixture server's `/jev` (`IPX_TYPESAFE_URL`), which refuses the shape TypeSafe refuses, and