refactor(fe): eliminate every explicit any; enforce no-explicit-any (R7 S3a·4)

Removes all 13 remaining `any`s and flips the ESLint rule from off to error so
new ones can't creep back:
- api.ts prefs/data JSON bags: Record<string, any> -> Record<string, unknown>,
  narrowed at consumers (App language guard; NotificationsPanel shapes the
  notification `data` per type behind its existing typeof guards)
- catch (e: any) -> catch (e) + `e instanceof HttpError` narrowing
  (SettingsPanel, SetupWizard, PlexPlayer)
- the YouTube IFrame API boundary: new lib/youtube.ts types (YTPlayer/
  YTPlayerEvent/YTNamespace + a Window augmentation) replace the 6 player anys;
  tsc surfaced the exact method surface to declare
- NotificationsPanel `t` props: any-options -> i18next TFunction

Gate green: typecheck (app+node+e2e), eslint 0 errors (rule now enforced),
prettier, 74 vitest.

frontend/src/lib/api.ts

@@ -17,7 +17,7 @@ export interface Me {
   can_read: boolean;
   can_write: boolean;
   pending_invites: number;
-  preferences: Record<string, any>;
+  preferences: Record<string, unknown>;
 }
 
 export interface DemoWhitelistEntry {
@@ -622,7 +622,7 @@ export interface AppNotification {
   type: string;
   title: string;
   body: string | null;
-  data: Record<string, any> | null;
+  data: Record<string, unknown> | null;
   read: boolean;
   dismissed: boolean;
   created_at: string | null;
@@ -1189,7 +1189,7 @@ export const api = {
   pauseSync: () => req("/api/sync/pause", { method: "POST" }),
   resumeSync: () => req("/api/sync/resume", { method: "POST" }),
   // Overwriting preferences is idempotent, so let it retry on a transient gateway blip.
-  savePrefs: (p: Record<string, any>) =>
+  savePrefs: (p: Record<string, unknown>) =>
     req("/api/me/preferences", { method: "PUT", body: JSON.stringify(p) }, { idempotent: true }),
 
   // --- channel manager ---