Merge: R2 S1 — quality gate wiring (build typecheck, knip pin, publish gate)

.dockerignore

@@ -6,8 +6,17 @@
 **/*.pyc
 .venv/
 venv/
-node_modules/
+# Docker patterns are anchored at the context root with NO implicit `**/` (unlike .gitignore, where
+# this same line matches at any depth) — a bare `node_modules/` missed frontend/node_modules, so
+# `COPY frontend/ ./` overlaid the host's Windows tree on top of what `npm ci` had just installed.
+**/node_modules/
 frontend/dist/
+# Host-only test artifacts. e2e/.auth/state.json is a live Playwright session: it never reached the
+# runtime image (stage 2 copies only /fe/dist), but it has no business in the build context either.
+frontend/e2e/.auth/
+frontend/playwright-report/
+frontend/test-results/
+**/*.log
 backups/
 *.dump
 README.md

frontend/package.json

@@ -4,10 +4,16 @@
   "type": "module",
   "scripts": {
     "dev": "vite",
-    "build": "vite build",
+    "typecheck": "npm run typecheck:app && npm run typecheck:node && npm run typecheck:e2e",
+    "typecheck:app": "tsc --noEmit -p tsconfig.json",
+    "typecheck:node": "tsc -p tsconfig.node.json",
+    "typecheck:e2e": "tsc --noEmit -p e2e/tsconfig.json",
+    "build": "npm run typecheck:app && npm run typecheck:node && vite build",
     "preview": "vite preview",
+    "knip": "knip",
     "test": "vitest run",
-    "test:watch": "vitest"
+    "test:watch": "vitest",
+    "e2e": "playwright test"
   },
   "dependencies": {
     "@dnd-kit/core": "^6.3.1",
@@ -31,6 +37,7 @@
     "@types/react-dom": "^18.3.0",
     "@vitejs/plugin-react": "^4.3.1",
     "autoprefixer": "^10.4.19",
+    "knip": "6.27.0",
     "postcss": "^8.4.39",
     "tailwindcss": "^3.4.6",
     "typescript": "^5.5.3",

frontend/src/components/ConfirmProvider.tsx

@@ -10,7 +10,7 @@ import Modal from "./Modal";
 // confirms, because the second dialog's Cancel/Escape/backdrop is then indistinguishable from
 // a deliberate answer (the playlist delete used to read a dismissal as "delete here only" and
 // went ahead and deleted).
-export interface ConfirmOptions {
+interface ConfirmOptions {
   title?: string;
   message: ReactNode;
   confirmLabel?: string;
@@ -18,7 +18,7 @@ export interface ConfirmOptions {
   danger?: boolean;
 }
 
-export interface Choice {
+interface Choice {
   id: string;
   label: string;
   danger?: boolean;

frontend/tsconfig.json

@@ -15,5 +15,10 @@
     "noUnusedLocals": true,
     "noUnusedParameters": true
   },
-  "include": ["src"]
+  "include": ["src"],
+  // Editors resolve a file to the nearest tsconfig that INCLUDES it; vite.config.ts / vitest.config.ts
+  // are in neither this project's `include` nor e2e's, so without this reference the language service
+  // falls back to an inferred project (non-strict, DOM lib) and shows you different errors than
+  // `npm run typecheck` does. The reference makes the editor and the gate agree.
+  "references": [{ "path": "./tsconfig.node.json" }]
 }

frontend/tsconfig.node.json

@@ -0,0 +1,28 @@
+{
+  // The build-tool configs run in Node, not the browser: they need node types and must NOT be
+  // checked against the app's DOM lib. Split out because tsconfig.json's `include` is ["src"],
+  // so until now nothing type-checked these files at all (R2 / C-4.5). `npm run typecheck`
+  // runs this project alongside src and e2e.
+  "compilerOptions": {
+    // composite: required to be the target of tsconfig.json's `references` (which is what makes
+    // editors check these files under THIS config instead of an inferred one). A composite project
+    // may not disable emit (TS6310), so it emits declarations only, into node_modules — nothing
+    // lands in the repo and nothing reaches the bundle. Hence `tsc -p` without --noEmit below.
+    "composite": true,
+    "declaration": true,
+    "emitDeclarationOnly": true,
+    "outDir": "./node_modules/.tmp/tsconfig-node",
+    "tsBuildInfoFile": "./node_modules/.tmp/tsconfig-node/.tsbuildinfo",
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "lib": ["ES2022"],
+    "types": ["node"],
+    "strict": true,
+    "skipLibCheck": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "resolveJsonModule": true
+  },
+  "include": ["vite.config.ts", "vitest.config.ts"]
+}

frontend/vitest.config.ts

@@ -7,7 +7,10 @@ import { defineConfig } from "vitest/config";
 // component has to wire @vitejs/plugin-react (and a DOM environment) here itself.
 export default defineConfig({
   test: {
-    include: ["src/**/*.test.ts"],
+    // .tsx included on purpose: a test file the glob misses does not fail, it is simply never
+    // collected, and the gate still prints green. (Such a test must still wire plugin-react +
+    // a DOM environment here — see above — but at least it will run and say so.)
+    include: ["src/**/*.test.{ts,tsx}"],
     environment: "node",
   },
 });