fix: polish pass — kill 50+ TS errors and the 1 failing test

fix: polish pass — kill 50+ TS errors and the 1 failing test

Baseline before this session: 1 failing test (broken refactor leftover),
50+ TypeScript errors across the tree. None blocked tests at runtime
because Bun runs TS leniently, but the compiler surface was noisy enough
to hide real bugs and slow the next polish pass.

Real bugs found and fixed:

- src/__tests__/crontech-deploy.test.ts — a refactor left
  `installFetchCapture` (never defined) plus shorthand `after, before`
  references with no in-scope bindings. Rewritten to use the in-file
  `captureFetch()` helper and declare the SHA fixtures inline.
- src/routes/pulls.tsx — `getRepoPath` was imported twice (named in two
  separate blocks). TS flagged the duplicate identifier; runtime was
  surviving on hoisting. Removed the orphan import.
- src/lib/workflow-runner.ts — `_coerceExtParsed` was called but never
  defined. Workflows that successfully parsed via the v2 extended parser
  would have crashed the runner. Added the coercion helper that maps an
  `ExtendedParseResult` to the v1 `ParsedWorkflow` shape this runner
  consumes; falls back to null on malformed input so callers degrade to
  the locked v1 parser.
- src/lib/mcp-tools.ts — `codebase_explanations` schema has
  `generatedAt`, not `createdAt`. MCP `gluecron_repo_explain_codebase`
  tool was selecting + ordering by a non-existent column, which would
  have thrown at runtime once a caller invoked it.
- src/lib/follows.ts — `listFollowers` / `listFollowing` selected an
  explicit subset of `users` columns but missed `isAdmin`. The return
  type `User[]` requires `isAdmin`, so callers consuming `.isAdmin` on
  the result would have read `undefined`.
- src/lib/auto-repair.ts — `commitSha: result.sha` could be `undefined`
  but `recordRepair` expects `string | null`. Coerced via `?? null`.

Type-system polish:

- src/middleware/auth.ts — `AuthEnv.Variables` was missing entries for
  context vars actually set by other middleware: `csrfToken`,
  `requestId`, `requestStart`, `repository`, `repoAccess`, `authMethod`,
  `tokenScopes`. Declared them as optionals so `c.get(...)` resolves.
- src/app.tsx — top-level `new Hono()` is now typed `<AuthEnv>` so the
  global `onError` can read `requestId` without a never-cast.
- src/db/index.ts — the `AnyDb` union narrowed `.returning({...})` to
  the most-restrictive overload set (which has 0 args), causing 20+
  errors at call sites. Both drivers expose identical PG query-builder
  surfaces at runtime, so the exported proxy is now cast to
  `NeonHttpDatabase<typeof schema>` for ergonomics without changing
  runtime behaviour.
- src/middleware/repo-access.ts — programmatic `jsx(...)` calls had
  array-children shapes that didn't match Hono's stricter JSX child
  typing. Switched to spread-children + small `as any` casts since the
  helper is rendered only on the 403 path.
- src/views/ui.tsx — `Form` component now accepts `id` and `encType`
  (used by `specs.tsx` and would-be file-upload forms).
- src/routes/import.tsx, src/routes/import-bulk.tsx — `method="POST"`
  → `method="post"` (HTML attribute is lowercase per spec).
- src/views/live-feed.tsx, src/views/log-tail.tsx — dropped explicit
  `JSX.Element` return annotation; the namespace isn't in scope and
  Hono's JSX runtime infers correctly without it.

After: bunx tsc --noEmit → 0 errors. bun test → 1256 pass / 0 fail
(was 1255/1).

https://claude.ai/code/session_01RzRiNtuiTJYnSCP8r6Xj5z