build(frontend): knip also checks what ships; strict indexing in every project

`npm run knip` now runs a second, --production pass, which asks whether the
code that ships uses an export, not just whether anything does. Of the 47
exports only tests reached:
- 34 are exported for their test and say so with @internal, naming the test.
- 11 were module-private names with a stray `export`. Two of them were not
  used at all and are deleted.
- The unused alreadyReported re-export is gone.
Test kits, the e2e suite and the two build-tooling modules are excluded from
the production project, each named in knip.jsonc.

noUncheckedIndexedAccess is now on for the node and e2e tsconfigs too (0
errors), matching the app project. tsconfig.node.json listed a
tailwind.config.js that has not existed since Tailwind 4. That entry is now
playwright.config.ts, which the typed lint finds through this project.

frontend/src/lib/log.ts

@@ -21,7 +21,10 @@ import { FRONTEND_VERSION } from "./version";
 
 export type Level = "TRACE" | "DEBUG" | "INFO" | "WARNING" | "ERROR" | "CRITICAL";
 
-/** OpenTelemetry severity numbers — the same table as `logs.SEVERITY` (a contract test compares). */
+/**
+ * OpenTelemetry severity numbers — the same table as `logs.SEVERITY` (a contract test compares).
+ * @internal exported for log.contract.test.ts
+ */
 export const SEVERITY: Record<Level, number> = {
   TRACE: 1,
   DEBUG: 5,
@@ -59,6 +62,7 @@ export interface LogEvent {
 
 /** Events kept. At ~0.5 KB each the ring stays around a megabyte — a long session's worth of
  *  navigation and requests, without growing for as long as a tab stays open. */
+/** @internal exported for log.test.ts */
 export const RING_MAX = 2000;
 
 // --- redaction (mirrors backend/app/logs.py) ------------------------------------------------------
@@ -97,6 +101,7 @@ function redactText(text: string): string {
 
 /** Recursively scrub a structure destined for the log. A value whose KEY names a secret is dropped
  *  whole — a prefix of a token is still a leak. Everything else is scrubbed as text. */
+/** @internal exported for log.contract.test.ts */
 export function redact(value: unknown, key = ""): unknown {
   const lowered = key.toLowerCase();
   if (key && SECRET_KEY_PARTS.some((part) => lowered.includes(part))) return REDACTED;