feat(scripts): generate typed JS API contract and type-check with tsc --checkJs (#1097, #1098)

[rumblefrog]

Closes #1097, closes #1098. Sequenced as one PR because #1098 imports the
Actions / Perms exports produced by #1097 — splitting them would require
two CI passes' worth of churn for no gain.

Summary

#1097 — Generate typed JS API contract from PHP handler registry

• New web/bin/generate-api-contract.php parses web/api/handlers/_register.php
  for action names + permission masks, reads web/configs/permissions/web.json
  for the canonical ADMIN_* constants, and emits web/scripts/api-contract.js
  with Actions and Perms globals plus @typedefs for every action. Output
  is alphabetically sorted and byte-stable across runs.
• Wired as composer api-contract and into .github/workflows/api-contract.yml,
  which fails CI if the file is out of date.
• Every sb.api.call('foo.bar', …) literal in web/scripts/, web/themes/,
  AND web/pages/ is migrated to Actions.PascalName. The hand-rolled
  ADMIN_* block at the top of sourcebans.js is gone; references go
  through Perms.*.

#1098 — Type-check vanilla JS with tsc --checkJs and JSDoc

• New web/package.json (TypeScript dev-only — nothing ships from
  node_modules/) + web/scripts/tsconfig.json with checkJs, noEmit,
  strict, strictNullChecks.
• Every .js under web/scripts/ carries // @ts-check. JSDoc annotations
  on sb.* and sb.api.* exported surface; ambient declarations in
  web/scripts/globals.d.ts for the cross-file shapes.
• New sb.$idRequired(id) helper for "missing element is a programmer
  error" call sites; sb.$id() callers that handle absence narrow with
  if (!el) return;.
• ./sbpp.sh ts-check runs tsc --noEmit inside the web container; new
  .github/workflows/ts-check.yml runs the same gate in CI on every PR.
• docker/Dockerfile gains nodejs npm (Debian 12 ships Node 20).
  docker/README.md documents the gate alongside phpstan and test.

Review-cycle fixups (third commit)

A reviewer pass surfaced three nits, all addressed before push:

• Two missed sb.api.call('...') literals in web/pages/admin.bans.php
  and admin.comms.php migrated to Actions.*.
• SbAnyEl doc updated to honestly describe the legacy/strict trade-off
  (form members declared REQUIRED to keep call sites compiling, with a
  flagged hazard and a pointer to a typed-helper follow-up).
• Generated api-contract.js banner now calls out that most Api…Request
  / …Response typedefs are intentional Object placeholders pending
  per-handler docblocks.

Test plan

• ./sbpp.sh composer api-contract runs cleanly; second run produces
  a byte-identical file (verified with diff /tmp/snapshot api-contract.js).
• ./sbpp.sh phpstan — [OK] No errors.
• ./sbpp.sh test — OK (37 tests, 99 assertions).
• ./sbpp.sh ts-check — exit 0, zero diagnostics.
• rg "sb\.api\.call\(\s*['\"]" web/ — no matches anywhere in web/.
• rg "^\s*(const|var|let)\s+ADMIN_" web/scripts/ — no matches.
• All web/scripts/*.js carry // @ts-check.
• node_modules/ ignored, not tracked.
• Manual smoke-test in CI's preview / reviewer's local stack: log in
  as admin, exercise an admin-page action that round-trips through
  sb.api.call, confirm no console errors.

Known gaps a reviewer should look at

• 49 of 56 generated typedefs are still Object placeholders. Tightening
  them is gated on adding @param/@return docblocks to the handler
  bodies — left as a follow-up so this PR doesn't sprawl.
• SbApiEnvelope.data is typed any for the same reason; converting it
  to a discriminated union keyed off Actions.* is the natural follow-up
  once handler docblocks land.
• SbAnyEl is intentionally permissive (see the doc comment). New code
  should prefer typed selectors; a follow-up issue could introduce
  sb.$input() / sb.$select() helpers and migrate call sites.