refactor(backend): type the remaining query results (#159)

Completes the typing. Every `.query(...)` in backend/src whose rows are read now carries a row type: adminCustomers, adminCategories, shippingAddresses, adminTags, adminEmailTemplates, adminSettings, public, server and the auth middleware. Typed sites go from 49 to 78, and there are no untyped reads left anywhere.

Writes and transaction control stay untyped, which is the exemption #159's criteria allow for and the reason is stated in each file: they return nothing anyone reads, and annotating them would bury the ones that matter.

The aggregates needed checking rather than guessing, and the answer was not what the shapes suggest. Postgres returns COUNT as bigint and SUM as numeric, and node-postgres hands both back as strings — only an explicit ::int cast arrives as a number. Probed against the real database: COUNT(*) is a string, COUNT(*)::int is a number, SUM() is a string, MAX(timestamptz) is a Date.

That makes the admin customer list a mixture. order_count and total_spent_cents are strings; reserved_count, which the query casts, is a number. They are typed as what they are.

Which surfaces a mismatch worth knowing about and not fixed here. frontend/src/admin/adminCustomersApi.ts declares both as `number`, and Customers.tsx sorts with `a.order_count - b.order_count` and renders with `(v / 100).toFixed(2)`. Those work, because `-` and `/` coerce a numeric string. The first `+` written against either — a column total, say — will concatenate instead. Nothing is broken today; the types on both sides simply disagree about reality, and one of them is now right. Changing the API to cast would alter the response shape, which is a behaviour change and belongs in its own issue.

Two smaller shapes worth a note. shipping_addresses.usps_standardized is jsonb that is only ever handed to the client, so it is `unknown` rather than a guessed object. And `SELECT 1 ... ` used purely for `.length` has no column name of its own — Postgres calls it `?column?` — so it is an index signature with nothing read out of it rather than a fabricated field.

Verified: tsc clean, unit 254/254, integration 238/238, backend lint unchanged from main.

Closes #159

backend/src/server.ts

@@ -10,7 +10,7 @@ import { validateEnv } from './envValidation';
 // Release cart holds whose expiry has passed.
 async function sweepExpiredCarts(): Promise<void> {
   try {
-    const { rows } = await pool.query(
+    const { rows } = await pool.query<ExpiredCartItemRow>(
       `DELETE FROM cart_items WHERE expires_at < now() RETURNING item_id`
     );
     for (const row of rows) {
@@ -25,7 +25,7 @@ async function sweepExpiredCarts(): Promise<void> {
 // their cart.
 async function sendCartReminders(): Promise<void> {
   try {
-    const { rows } = await pool.query(`
+    const { rows } = await pool.query<ReminderRow>(`
       SELECT c.email, c.first_name, c.last_name, i.name AS item_name, ci.expires_at, ci.id AS cart_item_id
       FROM cart_items ci
       JOIN carts ca ON ca.id = ci.cart_id
@@ -73,6 +73,21 @@ async function sendCartReminders(): Promise<void> {
   }
 }
 
+/** What the expiry sweep releases, so the items can be returned to the shop. */
+interface ExpiredCartItemRow {
+  item_id: number;
+}
+
+/** One held item and who to remind about it. */
+interface ReminderRow {
+  email: string;
+  first_name: string | null;
+  last_name: string | null;
+  item_name: string;
+  expires_at: Date;
+  cart_item_id: number;
+}
+
 // Neither scheduler has anything to await these with, so `void` states that the
 // promise is deliberately dropped. That is only safe because both functions
 // catch their own errors above — an escaping rejection would be unhandled, and