fix: sanitize Bash output, gate client configs, cap surveys, add fs:list globs - #374

## Requirement or Bug

Turn type checking back on in 23 files and fix the bugs it hid.
Follow-up to #374.

## Bug Reproduction Steps

1. **Config token lookup.** Set `CUSTOM_API_BASE_URL` and sign in with
an OAuth provider on that base. Start the TUI. The survey, cache-hint
and recommended-effort settings never load. Each caller runs
`harness.auth.getCachedAccessToken()` with no argument, and the auth
facade reads `.storage` of `undefined` and throws before the request.
2. **Device-code sign-in.** A device authorization response without
`verification_uri_complete` (it is optional in RFC 8628) makes the TUI
call `openUrl(undefined)` and show an empty URL in the sign-in box.
3. **Expert Talk panel.** A run without `artifacts` or `bindings` throws
in `buildExpertTalkStatusLines` (`Object.values(undefined)`,
`bindings[0]` of `undefined`).

## Root Cause

Every file in this list had `// @ts-nocheck` on line 1:
`src/tui/pythinker-tui.ts`,
`src/tui/controllers/{auth-flow,cache-hint-controller}.ts`,
`src/tui/commands/{auth,expert-talk,prompts}.ts`,
`src/tui/components/messages/{expert-talk-panel,agent-dynamic-workflow-progress}.ts`,
`src/utils/usage/usage-format.ts`, 12 test files, and 2
`apps/vis/server` files. So `tsc` passed while those files called APIs
with the wrong arguments. This PR removes every `@ts-nocheck` in the
repository and fixes each error. It is a fundamental fix: the checker
covers these files again, so the same class of error now fails CI.

## Code Changes

New: `apps/pythinker-code/src/utils/managed-access-token.ts`

```ts
managedAccessToken(auth, model, models, providers)
  entry = models[model]; provider = providers[entry.provider]
  if no oauth ref, or provider base !== CUSTOM_API_BASE_URL -> undefined (no token read)
  else auth.getCachedAccessToken(provider.oauth)
```

```diff
  survey refresh / cache-hint resolveConfig / recommended-effort fetchConfig
-   accessToken = harness.auth.getCachedAccessToken()            // always threw
+   accessToken = managedAccessToken(harness.auth, model, models, providers)

  CacheHintController.upstreamModelId
    requires provider.oauth
+   requires provider base === CUSTOM_API_BASE_URL

  showLoginAuthorizationPrompt
-   url = auth.verificationUriComplete
+   url = auth.verificationUriComplete ?? auth.verificationUri
```

The token only goes to the provider's own host:
`isManagedPythinkerCodeBaseUrl` compares the normalized provider base
URL with `CUSTOM_API_BASE_URL`. The client config request goes to the
same URL (#374).

Other type fixes, each with no behavior change:

- `packages/node-sdk/src/index.ts`: export `type LoginUi`. This is
additive. `auth.ts` imported it, but the SDK never exported it.
- `auth-flow.ts`: removed the `scope` option. The refresh orchestrator
never read it, so the model picker's "OAuth" refresh was always a full
refresh, and it still is. Removed the unused `resolveOAuthToken` closure
and the `any`-typed host field that was never forwarded.
- `auth.ts`: `promptPlatformSelection` returns `{ platformId, catalog
}`, so the `typeof selection === 'string'` branches were dead.
- `cache-hint-controller.ts`: `'dismiss'` is a controller-only outcome,
so it is now typed as `CacheHintAction | 'dismiss'`.
- `expert-talk.ts` / `expert-talk-panel.ts`: narrow the run error with
`typeof error === 'object'`, validate artifact states, and parse numeric
or ISO timestamps.
- `usage-format.ts`: skip quota entries without `usedRatio`, and keep
only string `resetAt`.
- `apps/vis/server`: fixed the import path of `TurnStepRetrying`,
declared `PromptAcceptedRecord` for old wires, and handled
`file_history.*` records in the context projector switch.
- Tests: typed the `opts()` helper, removed a DI pair that had no
service id, aligned the fixtures with the declared types, and stopped
spying through `never`.

## Behavior Changes and Affected Users

| Behavior | Before | After | Who relies on the old behavior | Escape
hatch |
|---|---|---|---|---|
| Survey / cache-hint / recommended-effort config with
`CUSTOM_API_BASE_URL` and an OAuth provider on that base | token lookup
threw; no request; built-in defaults | request with that provider's
token; server config applies | custom-base deployments (they never got
their config) | unset `CUSTOM_API_BASE_URL` |
| Same, provider not on the custom base | threw; no request | survey:
anonymous request to the custom base, no token; cache-hint and
recommended-effort: no request (their gates require the managed base) |
nobody | n/a |
| Cache-expiry hint for an OAuth provider off the custom base (for
example Codex OAuth) | hint could show with the managed cache rules | no
hint | users of non-managed OAuth providers who saw the hint | none; the
rules describe the managed cache only |
| Device-code sign-in without a complete URL | opened `undefined` |
opens `verificationUri` | nobody | n/a |
| Model picker refresh | full refresh of all providers | unchanged (full
refresh) | — | — |
| Expert Talk panel with a run missing `artifacts`/`bindings` | threw |
renders | nobody (the command has no caller yet) | n/a |

The SDK change is additive. In `packages/node-sdk/src/index.ts`,
`LoginUi` is now exported as a type. Existing SDK users do not change
anything.

Found, not fixed: the CLI Expert Talk ("Discussion") surface is not
wired up. `handleExpertTalkCommand` has no caller, and `SDKRpcClientV2`
implements none of the nine Expert Talk RPC methods, so
`Session.getExpertTalkStatus()` always throws "unavailable on this
engine". Users cannot reach it today. Building it is feature work for
another PR.

Coverage:

- `test/utils/managed-access-token.test.ts` (new): the token is read by
its OAuth ref only for a provider on the custom base, and never without
a custom base, without OAuth, or for an unknown model.
- `test/tui/controllers/cache-hint-controller.test.ts`: the managed
provider token reaches the fetch, and an OAuth provider off the base
never hints. Both fail without the fix.
- `test/tui/pythinker-tui-message-flow.test.ts`: "opens the plain
verification URL when the device flow has no complete URL". It fails
without the fix.
- Full gates: build, typecheck (tsc + tsgo), lint, sherif, full `pnpm
test`.

## Checklist

- [x] I have read the
[CONTRIBUTING](https://github.com/PyModel/pythinker-code/blob/main/CONTRIBUTING.md)
document.
- [ ] I have linked a related issue (external PRs: issue must have a
maintainer's `/approve`).
- [x] I have added tests that prove my feature works.
- [x] The behavior-change table above is complete, and every removed
behavior or flipped default is named in the changeset and either has an
escape hatch or was explicitly approved by a maintainer in this PR.
- [x] Ran `gen-changesets` skill, or this PR needs no changeset.
- [x] Ran `gen-docs` skill, or this PR needs no doc update.