build(ts): day 1 — bootstrap TypeScript, zero code changes

Installs TypeScript toolchain and configures it to accept every
existing .js file untouched. tsc --noEmit is green; the app runs
identically and nothing is deployed or rebuilt yet.

Config choices:
- extends @tsconfig/node20 (matches the runtime version)
- allowJs: true, checkJs: false — existing files pass through
- strict: false — tightened progressively on day 5, not day 1
- skipLibCheck: true — node_modules .d.ts quality varies, not our
  job on migration day
- paths: { "@shared/*": ["./shared/*"] } — pre-wired for the
  shared/types.ts file landing on day 2

Dependency notes:
- typescript 6.0.3 (current stable, released late 2025)
- @types/express pinned to ^4 because the app uses Express 4.21;
  the default npm install picked @types/express 5 which doesn't
  match runtime shapes for Request/Response
- @tsconfig/node20 for the known-good strict / module / target
  triple for Node 20 LTS
- ts-node-dev for the new `npm run dev` script — transpile-only
  mode, keeps startup fast

package.json script additions:
- build: tsc (compiles to dist/)
- typecheck: tsc --noEmit (CI-friendly)
- dev: ts-node-dev for TS-aware hot reload
- lint:refs: wraps the existing static reference linter

Left alone (no behavior change):
- start: still node server.js
- Dockerfile unchanged (prod still runs vanilla JS)
- All 54 backend .js files untouched

Day 1 scope matches the migration rule: no runtime behavior changes,
nothing deployed. Next: day 2 creates shared/types.ts and flips
server.js to server.ts.

Reference tag: pre-migration-v1 (commit 447eb78).

package.json

@@ -5,8 +5,12 @@
   "main": "server.js",
   "scripts": {
     "start": "node server.js",
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "dev": "ts-node-dev --respawn --transpile-only server.ts",
     "test": "node --test test/",
     "e2e": "./scripts/e2e.sh",
+    "lint:refs": "node scripts/lint-references.js",
     "maint:check": "node scripts/maintenance.js check",
     "maint:reindex": "node scripts/maintenance.js reindex",
     "migrate": "node-pg-migrate",
@@ -25,8 +29,8 @@
     "@tiptap/extension-text-style": "^3.20.4",
     "@tiptap/extension-underline": "^3.20.4",
     "@tiptap/starter-kit": "^3.20.4",
-    "axios": "^1.7.7",
     "argon2": "^0.41.1",
+    "axios": "^1.7.7",
     "bcryptjs": "^2.4.3",
     "cookie-parser": "^1.4.7",
     "cors": "^2.8.5",
@@ -54,5 +58,18 @@
     "@aws-sdk/client-transcribe-streaming": "^3.1017.0",
     "@aws-sdk/s3-request-presigner": "^3.700.0",
     "@google-cloud/vertexai": "^1.9.0"
+  },
+  "devDependencies": {
+    "@tsconfig/node20": "^20.1.9",
+    "@types/bcrypt": "^6.0.0",
+    "@types/cookie-parser": "^1.4.10",
+    "@types/cors": "^2.8.19",
+    "@types/express": "^4.17.25",
+    "@types/jsonwebtoken": "^9.0.10",
+    "@types/ms": "^2.1.0",
+    "@types/multer": "^2.1.0",
+    "@types/node": "^25.6.0",
+    "ts-node-dev": "^2.0.0",
+    "typescript": "^6.0.3"
   }
 }

tsconfig.json

@@ -0,0 +1,40 @@
+{
+  "extends": "@tsconfig/node20/tsconfig.json",
+  "compilerOptions": {
+    "outDir": "./dist",
+    "rootDir": "./",
+
+    "allowJs": true,
+    "checkJs": false,
+
+    "strict": false,
+    "noImplicitAny": false,
+    "strictNullChecks": false,
+
+    "esModuleInterop": true,
+    "resolveJsonModule": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "sourceMap": true,
+    "declaration": false,
+
+    "paths": {
+      "@shared/*": ["./shared/*"]
+    }
+  },
+  "include": [
+    "server.js",
+    "src/**/*.js",
+    "src/**/*.ts",
+    "shared/**/*.ts"
+  ],
+  "exclude": [
+    "node_modules",
+    "dist",
+    "public",
+    "e2e",
+    "scripts",
+    "test",
+    "client"
+  ]
+}