types: clear remaining tsc errors across 41 files (76→14, behavior-preserving)

Per-file type-only fixes surfaced after the Supabase client was correctly
typed. All fixes preserve runtime behavior; no any/ts-ignore/ts-expect-error.

- lib/supabase/client.ts: annotate the browser client as SupabaseClient<Database>
  (same ssr/js drift as server.ts; fixes it centrally for all callers).
- Supabase embedded-select joins whose FK metadata is missing from the
  generated types are bridged with `as unknown as <target>` + a TODO to remove
  after regenerating types/database.ts.
- setState optimistic-update variance and raw <select> enum values cast to the
  precise element/union type; .insert payload fields (Json, enums) given the
  precise column type via satisfies/field casts.
- Added narrowing guards where a value was legitimately nullable (comms channel,
  public form page) without changing the intended path.

The 14 remaining errors are confined to the four files fixed in Phase B (real
bugs + the tautological actions.test rewrite). 639 tests still green.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

lib/actions/imports.ts

@@ -5,6 +5,7 @@ import { createClient } from '@/lib/supabase/server'
 import { requireMemberWithRole } from '@/lib/auth-helpers'
 import { ADMIN_ROLES } from '@/lib/permissions'
 import { importMembersSchema } from '@/lib/validations'
+import type { TablesInsert } from '@/types/database'
 
 export async function importMembers(rows: unknown) {
   if (!Array.isArray(rows) || rows.length === 0) {
@@ -19,7 +20,7 @@ export async function importMembers(rows: unknown) {
   // Validate per row so one bad row does not reject the whole file; the
   // schema lowercases email and normalizes dates via flexibleDateTime.
   const rowSchema = importMembersSchema.element
-  const valid: Array<Record<string, unknown>> = []
+  const valid: Array<TablesInsert<'space_members'>> = []
   let skipped = 0
   for (const raw of rows) {
     const r = rowSchema.safeParse(raw)