fix(13-02): eliminate all ESLint violations — pnpm lint exits 0

- eslint.config.js: disable React Compiler rules (v7 flat.recommended enables
  them; codebase does not use the Compiler); add e2e/ to disableTypeChecked
  block; promote exhaustive-deps to error
- API broker: remove redundant as-casts (outboxWorker, poller, reminderScheduler,
  expand, sync, vevent, spike); add targeted ical.js no-unsafe-assignment/argument
  disables with justifying comments inside try blocks
- API routes/sse.ts: fix no-misused-promises on async writeSSE callback with
  void+IIFE+catch pattern
- API routes/lists.ts: let → const for updateValues
- API tests: remove unused imports (beforeEach, eq, vi); rename unused vars
  with _ prefix; remove unused lastActiveId assignment
- PWA components: void navigate() and void queryClient.invalidateQueries() on
  all fire-and-forget call sites; fix CalendarShell explicit-type-casts;
  Couldn't → HTML entity
- PWA test files: as unknown as Response for partial mock objects; string | null
  type annotation on mockLastSyncedUid; remove async from test callbacks without
  await; act(() => {}) not await act(async () => {}) for sync ops
- sw.ts: restructure Notification.data?.url access as let+if so disable
  comments land on the exact violation lines; void self.skipWaiting()

apps/api/src/broker/expand.ts

@@ -180,11 +180,13 @@ export function expandOccurrences(
   // --- 1. Parse VCALENDAR — return [] on malformed input (matches sync.ts pattern) ---
   let parsed: ReturnType<typeof ICAL.parse>
   try {
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment -- ical.js parse() returns 'any'; result is only passed to ICAL.Component which accepts it
     parsed = ICAL.parse(rawVevent)
   } catch {
     return []
   }
 
+  // eslint-disable-next-line @typescript-eslint/no-unsafe-argument -- ical.js parse() output is 'any'; ICAL.Component is the correct consumer of this value
   const comp = new ICAL.Component(parsed)
 
   // --- 2. Register VTIMEZONE components BEFORE constructing RecurExpansion (MANDATORY) ---
@@ -230,7 +232,7 @@ export function expandOccurrences(
       // Use ICAL.Event.endDate which derives end from DTEND, or DTSTART+DURATION, or sensible default.
       // Do NOT use getFirstPropertyValue('dtend') directly — events with only DURATION set return null,
       // producing zero-duration occurrences (BUG 1).
-      let occEnd: ICAL.Time = (event.endDate ?? dtstart) as ICAL.Time
+      let occEnd: ICAL.Time = event.endDate ?? dtstart
 
       // Positive-duration guard: ensure timed events have non-zero height in Schedule-X.
       if (!allDay && occEnd.compare(dtstart) <= 0) {

apps/api/src/broker/outboxWorker.ts

@@ -372,7 +372,7 @@ async function dispatchRow(row: OutboxRow): Promise<DispatchResult> {
             rruleFromPayload,
             fields.recurrenceUntil,
             fields.recurrenceCount,
-            fields.allDay as boolean,
+            fields.allDay,
           )
         : undefined
     } else if (preservedRrule) {
@@ -383,7 +383,7 @@ async function dispatchRow(row: OutboxRow): Promise<DispatchResult> {
           strippedPreset,
           fields.recurrenceUntil,
           fields.recurrenceCount,
-          fields.allDay as boolean,
+          fields.allDay,
         )
       } else {
         finalRruleString = preservedRrule
@@ -394,12 +394,12 @@ async function dispatchRow(row: OutboxRow): Promise<DispatchResult> {
 
     const { icsString } = buildVeventString({
       uid: row.uid,
-      summary: fields.title as string,
-      allDay: fields.allDay as boolean,
-      dtstart: fields.allDay ? (fields.start as string) : new Date(fields.start as string),
-      dtend: fields.allDay ? (fields.end as string) : new Date(fields.end as string),
-      location: fields.location as string | undefined,
-      description: fields.description as string | undefined,
+      summary: fields.title,
+      allDay: fields.allDay,
+      dtstart: fields.allDay ? fields.start : new Date(fields.start),
+      dtend: fields.allDay ? fields.end : new Date(fields.end),
+      location: fields.location,
+      description: fields.description,
       rruleString: finalRruleString,
     })
 
@@ -463,7 +463,7 @@ async function dispatchRow(row: OutboxRow): Promise<DispatchResult> {
             rruleFromPayload,
             fields.recurrenceUntil,
             fields.recurrenceCount,
-            fields.allDay as boolean,
+            fields.allDay,
           )
         : undefined
     } else if (preservedRrule) {
@@ -474,7 +474,7 @@ async function dispatchRow(row: OutboxRow): Promise<DispatchResult> {
           strippedPreset,
           fields.recurrenceUntil,
           fields.recurrenceCount,
-          fields.allDay as boolean,
+          fields.allDay,
         )
       } else {
         finalRruleString = preservedRrule
@@ -485,12 +485,12 @@ async function dispatchRow(row: OutboxRow): Promise<DispatchResult> {
 
     const { icsString } = buildVeventString({
       uid: row.uid,
-      summary: fields.title as string,
-      allDay: fields.allDay as boolean,
-      dtstart: fields.allDay ? (fields.start as string) : new Date(fields.start as string),
-      dtend: fields.allDay ? (fields.end as string) : new Date(fields.end as string),
-      location: fields.location as string | undefined,
-      description: fields.description as string | undefined,
+      summary: fields.title,
+      allDay: fields.allDay,
+      dtstart: fields.allDay ? fields.start : new Date(fields.start),
+      dtend: fields.allDay ? fields.end : new Date(fields.end),
+      location: fields.location,
+      description: fields.description,
       rruleString: finalRruleString,
     })
     // Build a minimal DAVCalendar for the write wrapper (only url is needed)

apps/api/src/broker/poller.ts

@@ -56,7 +56,7 @@ export async function runPoll(): Promise<void> {
 
         // ctag/syncToken: defensive null handling (Pitfall #6)
         const knownCtag = stored?.ctag ?? null
-        const currentCtag = (davCal.ctag ?? davCal.syncToken ?? null) as string | null
+        const currentCtag = davCal.ctag ?? davCal.syncToken ?? null
 
         // Skip if ctag is present on both sides and unchanged
         if (currentCtag !== null && currentCtag === knownCtag) {

apps/api/src/broker/reminderScheduler.ts

@@ -129,7 +129,7 @@ export async function runReminderCheck(now = new Date()): Promise<void> {
     if (row.subId != null) {
       byUid.get(row.uid)!.subs.push({
         id: row.subId,
-        userId: row.subUserId!,
+        userId: row.subUserId,
         endpoint: row.subEndpoint,
         p256dh: row.subP256dh,
         auth: row.subAuth,

apps/api/src/broker/spike.ts

@@ -50,7 +50,9 @@ async function main() {
   for (const cal of calendars) {
     console.log('---')
     console.log(`  url:         ${cal.url}`)
-    console.log(`  displayName: ${cal.displayName ?? '(none)'}`)
+    // displayName may be a string or a Record (language-tagged value) per CalDAV spec
+    const displayName = typeof cal.displayName === 'string' ? cal.displayName : JSON.stringify(cal.displayName ?? '(none)')
+    console.log(`  displayName: ${displayName}`)
     // ctag/syncToken: Fastmail may return either field (Pitfall #6)
     console.log(`  ctag:        ${(cal as { ctag?: string }).ctag ?? '(not returned)'}`)
     console.log(`  syncToken:   ${(cal as { syncToken?: string }).syncToken ?? '(not returned)'}`)

apps/api/src/broker/sync.ts

@@ -86,12 +86,14 @@ export async function syncCalendar(
 
     let parsed: ReturnType<typeof ICAL.parse>
     try {
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment -- ical.js parse() returns 'any'; result is only passed to ICAL.Component which accepts it
       parsed = ICAL.parse(obj.data as string)
     } catch {
       // Malformed VCALENDAR — skip but do not crash the sync
       continue
     }
 
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-argument -- ical.js parse() output is 'any'; ICAL.Component is the correct consumer of this value
     const comp = new ICAL.Component(parsed)
     const vevent = comp.getFirstSubcomponent('vevent')
     if (!vevent) continue
@@ -198,13 +200,14 @@ export async function syncCalendar(
         if ((oldRow.allDay ? true : false) !== allDay) changedFields.push('allDay')
 
         // Compare title (SUMMARY)
-        const oldTitle = (oldRow.title ?? null) as string | null
+        const oldTitle = oldRow.title ?? null
         if (oldTitle !== titleValue) changedFields.push('title')
 
         // Compare location — extract from old rawVevent for comparison
         let oldLocation: string | null = null
         if (oldRow.rawVevent) {
           try {
+            // eslint-disable-next-line @typescript-eslint/no-unsafe-argument -- ical.js parse() returns 'any'; ICAL.Component is the correct consumer of this value
             const oldComp = new ICAL.Component(ICAL.parse(oldRow.rawVevent))
             const oldVevent = oldComp.getFirstSubcomponent('vevent')
             if (oldVevent) {

apps/api/src/broker/vevent.ts

@@ -63,10 +63,12 @@ export const RRULE_PRESETS: Record<string, string> = {
 export function extractRruleString(rawVevent: string): string | undefined {
   let parsed: ReturnType<typeof ICAL.parse>
   try {
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment -- ical.js parse() returns 'any'; result is only passed to ICAL.Component which accepts it
     parsed = ICAL.parse(rawVevent)
   } catch {
     return undefined
   }
+  // eslint-disable-next-line @typescript-eslint/no-unsafe-argument -- ical.js parse() output is 'any'; ICAL.Component is the correct consumer of this value
   const comp = new ICAL.Component(parsed)
   const vevent = comp.getFirstSubcomponent('vevent')
   if (!vevent) return undefined

apps/api/src/routes/lists.ts

@@ -601,7 +601,7 @@ listItemsRouter.patch('/:itemId', zValidator('json', patchItemSchema), async (c)
     }
 
     // Build the update payload — single-field write with updatedAt=NOW()
-    let updateValues: {
+    const updateValues: {
       checked?: boolean
       text?: string
       rank?: string

apps/api/src/routes/sse.ts

@@ -93,12 +93,18 @@ sseRouter.get('/lists', async (c) => {
 
     // Subscribe to each accessible list's channel (D-04 — scoped, not global)
     for (const listId of accessibleListIds) {
-      const unsub = subscribeListEvents(listId, async (event) => {
-        if (stream.aborted) return
-        await stream.writeSSE({
-          data: JSON.stringify(event),
-          event: event.type,
-          id: `${listId}-${Date.now()}`,
+      const unsub = subscribeListEvents(listId, (event) => {
+        // The handler signature is void-returning; wrap the async write in void+catch.
+        // writeSSE errors are non-fatal — the SSE loop detects stream.aborted and cleans up.
+        void (async () => {
+          if (stream.aborted) return
+          await stream.writeSSE({
+            data: JSON.stringify(event),
+            event: event.type,
+            id: `${listId}-${Date.now()}`,
+          })
+        })().catch((err: unknown) => {
+          console.error('[sse] writeSSE error:', err)
         })
       })
       unsubscribers.push(unsub)