Enforce separate type-only imports

[Kevinjohn]

What & why

The documented separate type-import convention was not enforced, leaving the final requirement of #1342 unfinished. Enforce it across the linted TypeScript files and convert existing imports to separate import type statements.

consistent-type-imports fixes implicit type imports, while a syntax restriction rejects existing inline type specifiers. Type-query annotations remain allowed. The supporting UI checksum pins are refreshed for import-only edits; component behavior and public contracts are unchanged.

Closes #1342.
Closes #1338. Its recurring hotspots retain the accepted apply-when-touched disposition recorded in the issue.

Merge predecessor: none.

Validation

• Node 24.21.0.
• Temporary lint proof: implicit mixed imports are rejected and autofix to separate declarations; explicit inline type specifiers are rejected.
• Formatting, lint, type-checking, file-size policy and UI primitive checksum checks pass.
• All gate:all checks pass: 4,665 application tests, 2,593 server coverage tests, 56 account-flow tests, three credential-durability tests and three migration rehearsal tests. The gate was resumed from ui:check after correcting file-size failures and refreshing reviewed primitive hashes; earlier passing structural checks were retained.
• pnpm run e2e: 290 passed.
• Source review of all 391 changed TypeScript files found no changes outside imports; runtime-import removals and the consolidated import were reviewed for initialization effects.

Checklist

• The change and reason are described above.
• Validation commands are listed.
• No user-visible behavior change; no changelog entry required.
• Documentation inputs unchanged; no rebuild required.
• Authentication and sanitisation files have import-only edits; no migration or authorization changes.

[Kevinjohn]

Polish review: no P1/P2 findings.

• Runtime effect checked mechanically:
  • The app and shared code compile with verbatimModuleSyntax. There, turning import { type X } into import type { X } removes the module's runtime load.
  • This PR drops 30 such loads in src/ and shared/.
  • Every dropped module is side-effect free: only declarations, createContext, selector factories, or react, class-variance-authority and user-event. No initialisation changes.
  • The server compiles without verbatimModuleSyntax, so its unused imports were already elided.
• The rule fires as claimed. A probe file with an inline type specifier is rejected in src/, src/components/ui/, shared/src/, server/src/, server/scripts/ and e2e/.
• The ladder passes on Node 24: format, lint, typecheck, file sizes, server tsc, ui:check and a production vite build.
• The branch is current with main and has no conflicts. The batch that just landed passes the new rule.

Merge predecessor: none.