feat(web): define ChatEvent discriminated union, eliminate all any sites (R9)

Created web/src/lib/types.ts with discriminated unions for SSE event
payloads: ChatEvent (7 variants: session, tool_use, tool_result,
text_delta, text, done, error), ToolCallResult, MessageContent, and
typed data shapes for live events (PlanProposedData, PlanStepEventData,
QuestionRaisedData, QuestionAnsweredData, EntityTouchedData,
HealthChangedData) plus WailsGlobal for the desktop bridge.

Replaced all ~15 `any` sites across 7 files:
- api.ts: Message.content any -> MessageContent | string; removed local
  ChatEvent interface (now imported from types.ts as a discriminated
  union); JSON.parse cast to ChatEvent.
- stores/chat.ts: removed local ToolCallResult interface (imported from
  types.ts, re-exported for backward compat); extractApprovals accesses
  args with typeof guards instead of implicit any access; toChatMessages
  handles string|object Message.content cleanly.
- stores/activity.ts: update_plan_step seq/status extracted via typeof
  guards instead of `as any` casts; toolActivityLabel uses a str() helper
  for safe string extraction from unknown args.
- stores/workspace.ts: applyPlanStepEvent takes PlanStepEventData;
  applyEvent casts data to Record<string, unknown>; switch cases cast to
  typed interfaces (PlanProposedData, QuestionRaisedData, etc.) instead
  of `as any`; applyHealthChanged uses HealthChangedData.
- Config.svelte: (window as any).wails -> typed WailsGlobal cast;
  catch (e: any) -> catch (e: unknown) with instanceof Error check.
- utils.ts: WithoutChild/WithoutChildren `any` -> `unknown`.
- vite.config.ts: authProxy proxy/proxyReq `any` -> ProxyOptions type.

Result: eslint no-explicit-any warnings dropped 12 -> 0. Tests (6/6) and
build pass. VERSION 0.7.10 -> 0.7.11. Plan R9 marked done.

web/vite.config.ts

@@ -1,4 +1,5 @@
 /// <reference types="vitest/config" />
+import type { ProxyOptions } from 'vite'
 import { svelte } from '@sveltejs/vite-plugin-svelte'
 import tailwindcss from '@tailwindcss/vite'
 import { readFileSync, existsSync } from 'fs'
@@ -17,12 +18,12 @@ if (existsSync('../VERSION')) {
 // Injects OIKOS_API_TOKEN into proxied /api requests in dev — the API no
 // longer has a dev-open bypass (plans/2026-07-12-wails-desktop-app.md 0.4),
 // so `OIKOS_API_TOKEN=dev-token npm run dev` needs this to reach it.
-function authProxy(target: string, rewrite?: (path: string) => string) {
+function authProxy(target: string, rewrite?: (path: string) => string): ProxyOptions {
   return {
     target,
     ...(rewrite ? { rewrite } : {}),
-    configure: (proxy: any) => {
-      proxy.on('proxyReq', (proxyReq: any) => {
+    configure: (proxy) => {
+      proxy.on('proxyReq', (proxyReq) => {
         const token = process.env.OIKOS_API_TOKEN
         if (token) proxyReq.setHeader('Authorization', `Bearer ${token}`)
       })