types: clear remaining tsc errors across 41 files (76→14, behavior-preserving)

Per-file type-only fixes surfaced after the Supabase client was correctly
typed. All fixes preserve runtime behavior; no any/ts-ignore/ts-expect-error.

- lib/supabase/client.ts: annotate the browser client as SupabaseClient<Database>
  (same ssr/js drift as server.ts; fixes it centrally for all callers).
- Supabase embedded-select joins whose FK metadata is missing from the
  generated types are bridged with `as unknown as <target>` + a TODO to remove
  after regenerating types/database.ts.
- setState optimistic-update variance and raw <select> enum values cast to the
  precise element/union type; .insert payload fields (Json, enums) given the
  precise column type via satisfies/field casts.
- Added narrowing guards where a value was legitimately nullable (comms channel,
  public form page) without changing the intended path.

The 14 remaining errors are confined to the four files fixed in Phase B (real
bugs + the tautological actions.test rewrite). 639 tests still green.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

lib/door/executor.ts

@@ -111,7 +111,7 @@ async function egress(opts: {
       }
     }
     const snippet = redactDoorSecrets(received.slice(0, opts.snippetLen), opts.redactSecret, opts.redactAuthParam)
-    return { ok: res.ok, status: res.status, snippet }
+    return { ok: res.ok, status: res.status, snippet } as DoorCallResult
   } catch (e) {
     const msg = e instanceof Error ? e.message : 'request failed'
     return { ok: false, reason: redactDoorSecrets(msg, opts.redactSecret, opts.redactAuthParam) }

lib/door/ingest.ts

@@ -6,6 +6,7 @@
 // outbound actions.
 
 import type { createAdminClient } from '@/lib/supabase/admin'
+import type { TablesInsert } from '@/types/database'
 import { callDoor } from './executor'
 import { resolveDoorSecret } from './secret'
 import { encodeHeatSyncControl, applyTemplate, redactDoorSecrets } from '@/lib/door-logic'
@@ -88,7 +89,7 @@ export async function ingestEvents(
       null,
     )
 
-    const row: Record<string, unknown> = {
+    const row: TablesInsert<'door_access_log'> = {
       space_id: spaceId,
       connection_id: connectionId,
       actor_member_id: null,