chore(ci): clear the lint debt and make lint blocking (#79)

CI ran lint with continue-on-error because 23 errors predated it. All are
fixed, so the flag is gone and a typecheck step is added beside it — nothing
else in CI compiles the test files, so a type error in a fixture could only
ever be found on a developer's machine.

Real fixes, no blanket disables and no suppressions:

- react-hooks/set-state-in-effect (6): each was "reset or seed state when an
  input changes", so each becomes a state adjustment during render behind a
  previous-value guard — the documented React pattern for it. Two were also
  latent bugs. transactions/page.tsx depended on `others`, rebuilt by .filter()
  every render, so the effect already ran every render, one commit late.
  shared/page.tsx depended on the `tagIds` array identity, so the row window
  was reset more often than "changing any filter" claims — including after
  "Show more", the one interaction it must not undo; the key now joins by
  value. csv-import-modal reads localStorage once at mount, which is a lazy
  useState initializer, not an effect (SSR-guarded, though the modal is
  mounted from client state and never prerenders).
- react-hooks/static-components (3): SortIcon was declared inside SharedPage,
  making it a new component type on every render. Hoisted to module scope with
  the sort state passed as props.
- @typescript-eslint/no-explicit-any (9): the dynamically imported route
  handlers in two integration tests. Typed as their real signatures with one
  `as unknown as NextRequest` cast at the fixture boundary, so the call sites
  and response bodies get checked instead of opted out.
- react/no-unescaped-entities (5): exact-equivalent entities (', "),
  so no rendered text changes.

Also fixes the one pre-existing tsc error (unit/order-ingestion.test.ts:511):
`options` is optional, and `?? 0` keeps the assertion failing on an absent
list rather than silencing it with a non-null bang.

9 warnings remain (no-unused-vars, exhaustive-deps). eslint exits 0 on
warnings, so lint blocks on errors only — deliberately, since none of the
remaining warnings should stop a push.

.gitea/workflows/ci.yml

@@ -22,10 +22,18 @@ jobs:
       # the normal colour.
       - name: Generate Prisma client
         run: npx prisma generate
-      # Advisory until the pre-existing lint debt is cleared (2026-07-19:
-      # ~20 errors across budget/insights/shared pages) — then make blocking.
-      - name: Lint (advisory)
+      # Blocking since #79. It was advisory from 2026-07-19 while 23 errors sat
+      # across the pages and the integration tests; those are now fixed, so a
+      # new one must not be able to slip in behind a green tick. Warnings are
+      # still allowed (eslint exits 0 on them) — there are 9 left, all
+      # `no-unused-vars` or `exhaustive-deps` advisories, none of which should
+      # stop a push.
+      - name: Lint
         run: npm run lint
-        continue-on-error: true
+      # Typecheck is separate from `next build`: nothing else in CI compiles the
+      # test files, so a type error in a fixture could only ever be found on a
+      # developer's machine.
+      - name: Typecheck
+        run: npx tsc --noEmit
       - name: Unit tests
         run: npm test