fix(10-04): prettier format + remove unnecessary type assertions

- Run prettier on all new/modified PWA files (CredentialSheet, SetupBanner, AdminPage, admin.spec.ts)
- Remove unnecessary 'as React.RefObject<HTMLElement | null>' casts flagged by @typescript-eslint/no-unnecessary-type-assertion
- Format pre-existing API files from Plans 02/03 (me.ts, user.test.ts, requireAdmin.test.ts, me.test.ts)
- All 270 API tests + 191 PWA vitest tests pass; lint/typecheck/build clean

apps/api/src/routes/me.ts

@@ -167,35 +167,36 @@ const meNoEchoHook = (result: { success: boolean }, c: Context) => {
   }
 };
 
-meRouter.post(
-  '/credential',
-  zValidator('json', meCredentialSchema, meNoEchoHook),
-  async (c) => {
-    // Pitfall 6: ALWAYS resolve currentUserId from the session — never from the body.
-    const currentUserId = await resolveUserId(c);
-    if (!currentUserId) {
-      return c.json({ error: 'Unauthorized' }, 401);
+meRouter.post('/credential', zValidator('json', meCredentialSchema, meNoEchoHook), async (c) => {
+  // Pitfall 6: ALWAYS resolve currentUserId from the session — never from the body.
+  const currentUserId = await resolveUserId(c);
+  if (!currentUserId) {
+    return c.json({ error: 'Unauthorized' }, 401);
+  }
+
+  const { fastmailEmail, appPassword, providerType } = c.req.valid('json');
+  // T-10-10: NEVER log appPassword or c.req.valid('json') here
+
+  try {
+    // D-07: identical validate→encrypt→store→sync path as admin, but always with
+    // currentUserId (not a body userId). Admin passes the target member's userId;
+    // self-service passes the authenticated session userId. Same helper, same argument order.
+    await validateEncryptAndStoreCredential(
+      currentUserId,
+      fastmailEmail,
+      appPassword,
+      providerType,
+    );
+  } catch (err) {
+    if (err instanceof CredentialValidationError) {
+      return c.json({ error: 'Invalid request' }, 400);
     }
+    console.error(
+      '[me/POST /credential] Unexpected error:',
+      err instanceof Error ? err.message : String(err),
+    );
+    return c.json({ error: 'Service unavailable' }, 503);
+  }
 
-    const { fastmailEmail, appPassword, providerType } = c.req.valid('json');
-    // T-10-10: NEVER log appPassword or c.req.valid('json') here
-
-    try {
-      // D-07: identical validate→encrypt→store→sync path as admin, but always with
-      // currentUserId (not a body userId). Admin passes the target member's userId;
-      // self-service passes the authenticated session userId. Same helper, same argument order.
-      await validateEncryptAndStoreCredential(currentUserId, fastmailEmail, appPassword, providerType);
-    } catch (err) {
-      if (err instanceof CredentialValidationError) {
-        return c.json({ error: 'Invalid request' }, 400);
-      }
-      console.error(
-        '[me/POST /credential] Unexpected error:',
-        err instanceof Error ? err.message : String(err),
-      );
-      return c.json({ error: 'Service unavailable' }, 503);
-    }
-
-    return c.json({ ok: true }, 200);
-  },
-);
+  return c.json({ ok: true }, 200);
+});