chore: install ts-reset in both portal and app SPAs

Installs @total-typescript/ts-reset 0.6.1 as a dev-dependency in
apps/portal/ and apps/app/. Patches TypeScript's loosest default
types: Array.filter(Boolean) returns non-nullable, JSON.parse
returns unknown, fetch().json() returns unknown, Map.get() strict,
etc.

Configuration: src/reset.d.ts in each SPA imports the reset. Both
tsconfig.json files already include ./src/**/* so the .d.ts is
picked up automatically — no tsconfig edits needed.

Issues surfaced during install:
  - apps/app — 0 pre-install tsc errors in own code; install
    surfaced 2 errors in src/stores/useImpersonationStore.ts
    (both from JSON.parse on sessionStorage content returning
    unknown instead of any). Fixed inline at lines 19 + 123 via
    `as ImpersonationState` casts that make the existing
    trust-in-sessionStorage explicit. Backlog entry
    TECH-TS-IMPERSONATION tracks proper runtime shape validation.
  - apps/portal — 22 pre-existing tsc errors in own code (mostly
    tiptap editor components — tracked as TECH-TS-PORTAL-TSC,
    unrelated to ts-reset). Zero new errors in portal's own code.
    4 additional errors surfaced in tiptap's uncompiled node_modules
    .ts sources (third-party); left as-is.

Neither SPA achieves `tsc --noEmit` clean today — pre-existing
state unrelated to this work package. Build + vitest are the
actual working gates and both remain green:
  - apps/portal: vitest 113/113 passing; production build succeeds
  - apps/app:    (no vitest setup — tracked as TECH-APP-VITEST);
                 production build succeeds

Documentation: /dev-docs/FRONTEND-TOOLING.md added; CLAUDE.md
quality-gates updated.

Backlog: TECH-TS-IMPERSONATION (runtime validation of stored
impersonation state), TECH-TS-PORTAL-TSC (pre-existing portal tsc
errors), TECH-APP-VITEST (Vitest coverage for apps/app).

No production behavior change.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

dev-docs/BACKLOG.md

@@ -967,5 +967,49 @@ blijft handmatig.
 
 ---
 
+## Frontend type-safety
+
+### TECH-TS-IMPERSONATION — runtime validation of impersonation state
+
+**Aanleiding:** ts-reset install (april 2026) surfaced dat
+`apps/app/src/stores/useImpersonationStore.ts` blindly vertrouwt
+op `JSON.parse(sessionStorage.getItem(...))`. De return is nu
+`unknown` in plaats van `any`; we fixten dit door twee `as
+ImpersonationState` casts toe te voegen. Die maken de bestaande
+trust expliciet maar valideren de shape niet.
+**Wat:** vervang beide casts (lines 19 + 123) door een
+narrowing-helper `parseStoredState(raw: string | null):
+ImpersonationState | null` die het JSON parseert, de verwachte
+keys controleert (incl. geneste `impersonatedUser: AdminUser`
+fields), en `null` teruggeeft als de shape niet klopt. Zelfde
+helper gebruiken bij beide call sites. sessionStorage is in theorie
+tamperbaar door lokale users, dus dit is ook een kleine security
+verbetering.
+**Prioriteit:** Laag — defensive hardening, geen user-impact.
+
+### TECH-TS-PORTAL-TSC — portal tsc --noEmit cleanup
+
+**Aanleiding:** Portal heeft 22 pre-existing tsc errors (+4 in
+tiptap node_modules) die niets met ts-reset te maken hebben — meest
+TiptapEditor/ProductDescriptionEditor commands en één losse
+`@iconify/types` missing, themeConfig type-lowercase issue. CI
+checkt tsc niet (build + vitest wel), dus het wordt momenteel
+genegeerd. Fix zodra tiptap upgrade beschikbaar komt of per-
+component via type-casts.
+**Prioriteit:** Laag — niet-blocking, bestaand probleem.
+
+### TECH-APP-VITEST — bring Vitest coverage to apps/app
+
+**Aanleiding:** ts-reset install (april 2026) onderstreepte dat
+`apps/app/` geen test-script of `tests/` directory heeft. Portal
+heeft wel Vitest-coverage (113 tests); organizer-SPA heeft alleen
+build + typecheck als geautomatiseerde gates.
+**Wat:** Vitest setup in `apps/app/`, met eerste coverage op de
+kern-stores (waaronder `useImpersonationStore.ts` dat nu zonder
+runtime-test leeft).
+**Prioriteit:** Middel.
+
+---
+
 _Laatste update: April 2026_
 _Voeg nieuwe items toe met prefix: ARCH-, COMM-, OPS-, VOL-, ART-, FORM-, SUP-, DIFF-, APPS-, TECH-, UX-_