chore(ts): remove @ts-nocheck from 3 small backend files

Files de-nocheck'd with proper minimal types:

- src/db/database.ts: cast (db as any)._cleanupInterval — intentional
  runtime augmentation of the exported db handle.
- src/routes/audioBackups.ts: type the new Promise<Buffer>(...) wrappers
  around zlib.gzip / zlib.gunzip so .length is recognized.
- src/routes/documents.ts: var config: any for the S3 client config
  built piecemeal across env-var branches.

Still @ts-nocheck (deferred — need real interface design):
- src/utils/ai.ts, embeddings.ts (multi-provider AI request shapes)
- src/routes/transcribe.ts, adminConfig.ts (Node 20 File global path)
- src/routes/auth.ts (response.json() unknown in TS6)

npm run typecheck → 0 errors.

src/db/database.ts

@@ -1,4 +1,3 @@
-// @ts-nocheck — TS migration: needs proper typing in follow-up pass
 const { Pool } = require('pg');
 const fs = require('fs');
 const path = require('path');
@@ -519,6 +518,6 @@ function convertPlaceholders(sql) {
 }
 
 // Expose the cleanup-interval handle so the shutdown path can clear it.
-db._cleanupInterval = _cleanupInterval;
+(db as any)._cleanupInterval = _cleanupInterval;
 
 module.exports = db;

src/routes/audioBackups.ts

@@ -1,4 +1,3 @@
-// @ts-nocheck — TS migration: needs proper typing in follow-up pass
 // ============================================================
 // AUDIO BACKUPS ROUTES — Server-side audio backup storage
 // Stores compressed audio in PostgreSQL, auto-deletes after 24h
@@ -57,7 +56,7 @@ router.post('/audio-backups', upload.single('audio'), async function(req, res) {
     var raw = await fs.promises.readFile(tmpPath);
 
     // Gzip compress, then AES-256-GCM encrypt the audio data.
-    var compressed = await new Promise(function(resolve, reject) {
+    var compressed: Buffer = await new Promise<Buffer>(function(resolve, reject) {
       zlib.gzip(raw, { level: 6 }, function(err, result) {
         if (err) reject(err); else resolve(result);
       });
@@ -103,7 +102,7 @@ router.get('/audio-backups/:id/audio', async function(req, res) {
     // Decrypt (if encrypted row) then gunzip. Legacy rows are passed through.
     var ciphertext = row.audio_data;
     var gzipped = cryptoUtil.isEncryptedBuffer(ciphertext) ? cryptoUtil.decryptBuffer(ciphertext) : ciphertext;
-    var decompressed = await new Promise(function(resolve, reject) {
+    var decompressed: Buffer = await new Promise<Buffer>(function(resolve, reject) {
       zlib.gunzip(gzipped, function(err, result) {
         if (err) reject(err); else resolve(result);
       });

src/routes/documents.ts

@@ -1,4 +1,3 @@
-// @ts-nocheck — TS migration: needs proper typing in follow-up pass
 // ============================================================
 // DOCUMENTS ROUTES — S3-backed document upload & management
 // ============================================================
@@ -33,7 +32,7 @@ function getS3Client() {
   try {
     var { S3Client } = require('@aws-sdk/client-s3');
     var region = process.env.S3_REGION || process.env.AWS_BEDROCK_REGION || 'us-east-1';
-    var config = { region: region };
+    var config: any = { region: region };
 
     // Custom endpoint for S3-compatible providers (Backblaze B2, MinIO, etc.)
     if (process.env.S3_ENDPOINT) {