fix(12): satisfy CI fast-checks — lint unused vars, typed contract-test body, prettier

- Remove unused 'res'/'container' assignments (no-unused-vars)
- setupClient.contract.test.ts: typed parseSentBody helper + non-async json mock
  (no-unsafe-*/require-await)
- Prettier format 7 setup files

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/api/src/routes/setup.ts

@@ -148,7 +148,10 @@ setupRouter.post('/validate/db', async (c) => {
     await db.execute(sql`SELECT 1`);
     return c.json({ ok: true }, 200);
   } catch (err) {
-    console.error('[setup/validate/db] DB round-trip failed:', err instanceof Error ? err.message : String(err));
+    console.error(
+      '[setup/validate/db] DB round-trip failed:',
+      err instanceof Error ? err.message : String(err),
+    );
     return c.json({ ok: false, error: 'DB unavailable' }, 503);
   }
 });
@@ -217,7 +220,10 @@ setupRouter.post('/validate/vapid', async (c) => {
   const publicKey = process.env.VAPID_PUBLIC_KEY ?? '';
 
   if (!privateKey || !publicKey) {
-    return c.json({ ok: false, error: 'VAPID_PRIVATE_KEY and VAPID_PUBLIC_KEY env vars must be set' }, 400);
+    return c.json(
+      { ok: false, error: 'VAPID_PRIVATE_KEY and VAPID_PUBLIC_KEY env vars must be set' },
+      400,
+    );
   }
 
   // Gap 2: assert the operator-submitted public key matches the env public key BEFORE
@@ -230,11 +236,14 @@ setupRouter.post('/validate/vapid', async (c) => {
 
   const submittedPublicKey = submittedRow?.value;
   if (!submittedPublicKey || submittedPublicKey !== publicKey) {
-    return c.json({
-      ok: false,
-      error:
-        'VAPID public key does not match the configured key pair. Paste the exact VAPID_PUBLIC_KEY printed by `npm run generate-secrets`.',
-    }, 400);
+    return c.json(
+      {
+        ok: false,
+        error:
+          'VAPID public key does not match the configured key pair. Paste the exact VAPID_PUBLIC_KEY printed by `npm run generate-secrets`.',
+      },
+      400,
+    );
   }
 
   try {
@@ -248,10 +257,13 @@ setupRouter.post('/validate/vapid', async (c) => {
     );
     return c.json({ ok: true }, 200);
   } catch (err) {
-    return c.json({
-      ok: false,
-      error: err instanceof Error ? err.message : 'VAPID validation failed',
-    }, 400);
+    return c.json(
+      {
+        ok: false,
+        error: err instanceof Error ? err.message : 'VAPID validation failed',
+      },
+      400,
+    );
   }
 });
 
@@ -298,7 +310,9 @@ setupRouter.post('/credential', zValidator('json', credentialSchema, noEchoHook)
       )) as unknown as [{ count: string | number }[], unknown];
       const unclaimedCount = Number(countRows[0][0]?.count ?? 0);
       if (unclaimedCount > 0) {
-        throw Object.assign(new Error('An unclaimed user already exists'), { code: 'DUPLICATE_UNCLAIMED' });
+        throw Object.assign(new Error('An unclaimed user already exists'), {
+          code: 'DUPLICATE_UNCLAIMED',
+        });
       }
 
       // Step 1: Assign color (first unused from palette, or round-robin fallback)
@@ -322,20 +336,22 @@ setupRouter.post('/credential', zValidator('json', credentialSchema, noEchoHook)
         })
         .$returningId();
 
-      const [row] = await tx
-        .select()
-        .from(users)
-        .where(eq(users.id, inserted.id))
-        .limit(1);
+      const [row] = await tx.select().from(users).where(eq(users.id, inserted.id)).limit(1);
 
       return row;
     });
   } catch (err) {
-    if (err instanceof Error && (err as NodeJS.ErrnoException & { code?: string }).code === 'DUPLICATE_UNCLAIMED') {
+    if (
+      err instanceof Error &&
+      (err as NodeJS.ErrnoException & { code?: string }).code === 'DUPLICATE_UNCLAIMED'
+    ) {
       // A concurrent request already created the unclaimed admin row
       return c.json({ error: 'Setup already in progress' }, 409);
     }
-    console.error('[setup/POST /credential] Transaction error:', err instanceof Error ? err.message : String(err));
+    console.error(
+      '[setup/POST /credential] Transaction error:',
+      err instanceof Error ? err.message : String(err),
+    );
     return c.json({ error: 'Service unavailable' }, 503);
   }
 
@@ -353,12 +369,7 @@ setupRouter.post('/credential', zValidator('json', credentialSchema, noEchoHook)
   // Step 3: Validate + encrypt + store the credential via the shared helper (D-09)
   // The user row MUST exist before this call (Pitfall 5 — FK constraint).
   try {
-    await validateEncryptAndStoreCredential(
-      localUser.id,
-      fastmailEmail,
-      appPassword,
-      'caldav',
-    );
+    await validateEncryptAndStoreCredential(localUser.id, fastmailEmail, appPassword, 'caldav');
   } catch (err) {
     // Roll back the local user insert on credential failure to avoid orphaned rows
     await db.delete(users).where(eq(users.id, localUser.id));