fix(12): satisfy CI fast-checks — lint unused vars, typed contract-test body, prettier

- Remove unused 'res'/'container' assignments (no-unused-vars)
- setupClient.contract.test.ts: typed parseSentBody helper + non-async json mock
  (no-unsafe-*/require-await)
- Prettier format 7 setup files

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/api/tests/routes/setup.test.ts

@@ -203,7 +203,8 @@ async function seedCredential(userId: number): Promise<void> {
 // Env and DB cleanup between tests
 // ---------------------------------------------------------------------------
 
-const VAPID_PUBLIC_KEY = 'BKO9RLPqxNQ7GOLHsQ5kFXqMkfJBfElkd5h9ECQ0gRu7R5SJP6Ct5GkRuPxqY1u0UVY84_z7JGJsLhO-wChk_sE';
+const VAPID_PUBLIC_KEY =
+  'BKO9RLPqxNQ7GOLHsQ5kFXqMkfJBfElkd5h9ECQ0gRu7R5SJP6Ct5GkRuPxqY1u0UVY84_z7JGJsLhO-wChk_sE';
 const VAPID_PRIVATE_KEY = 'QEkqsrxLqpv_ynpCECWFLYlOxCEGd-_O5u0AXzY_qEY';
 
 beforeEach(async () => {
@@ -223,9 +224,7 @@ beforeEach(async () => {
 afterEach(async () => {
   // Clean up seeded rows between tests
   await db.delete(memberCredentials);
-  await db
-    .delete(users)
-    .where(eq(users.oidcIss, 'https://auth.test.setup'));
+  await db.delete(users).where(eq(users.oidcIss, 'https://auth.test.setup'));
   // Delete local (wizard-created) users with null oidcIss
   // We identify them by displayName prefix for safety
   // Use raw delete of unclaimed users (the test-seeded ones)
@@ -554,7 +553,7 @@ describe('POST /api/setup/credential', () => {
       displayName: 'OIDC User With claimed=false',
       color: '#4A90D9',
       isAdmin: false,
-      claimed: false,  // legacy/hypothetical — oidcIss is NOT NULL
+      claimed: false, // legacy/hypothetical — oidcIss is NOT NULL
     });
 
     mockValidateCredentialShouldThrow = false;
@@ -632,9 +631,8 @@ describe('/api/setup/* — 423 when effectively configured (D-10 effective-confi
     process.env.VAPID_PUBLIC_KEY = VAPID_PUBLIC_KEY;
 
     const app = await getApp();
-    const res = await app.fetch(jsonRequest('GET', '/api/setup/status'));
-    // status route always returns the status — but guard kicks in on mutation routes
-    // Test a mutation route to confirm 423
+    // The /status route always returns the status; the guard kicks in on mutation
+    // routes. Test a mutation route to confirm 423.
     const completeRes = await app.fetch(jsonRequest('POST', '/api/setup/complete'));
     expect(completeRes.status).toBe(423);
   });