fix(migration): repair server.js/.cts launch + require refs missed in the JS→TS migration

Full-deployment QA against a copy of the real DB surfaced launch/require
references the server .cts migration didn't update. All are non-source
tooling/edge paths, which is why typecheck/check/tests stayed green:

- e2e/setup/prepare-db.js: require('../../db/database') and
  require('../../scripts/seedDemoData') → .cts. This broke `npm run
  test:e2e*` entirely (harness couldn't load). [material]
- playwright.config.js + scripts/prod-smoke.sh: webServer/boot command
  `node server.js` → `node server.cts`. Also blocked the e2e + prod-smoke
  suites. [material]
- setup/firstRun.js → .cts, require('../services/auditService') → .cts,
  and server.cts call site → require('./setup/firstRun.cts'). Latent:
  server.cts only reaches firstRun when userCount===0, but database.cts
  auto-seeds a default admin during getDb() first, so the path isn't hit
  in normal boot — fixed defensively so it can't crash if ever reached.
- .env.example: doc reference `node server.js` → server.cts.

Verified: typecheck:server + check:server clean; server test suite
226/226; e2e probe 17/17 (was 0 — suite couldn't boot before); the
production Docker image builds and boots on a copy of the real
production DB (44 bills, 1159 payments) with /api/health 200 and all 64
page endpoints returning 2xx.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.example

@@ -1,7 +1,7 @@
 # ── Bill Tracker — Environment Variables ──────────────────────────────────────
 # Copy this file to .env and fill in your values before deploying.
 # Docker Compose reads .env automatically.
-# For direct Node.js: NODE_ENV=production node server.js (or use PM2).
+# For direct Node.js: NODE_ENV=production node server.cts (or use PM2).
 
 # ── Server ─────────────────────────────────────────────────────────────────────
 PORT=3000

e2e/setup/prepare-db.js

@@ -29,13 +29,13 @@ fs.mkdirSync(path.dirname(dbPath), { recursive: true });
 
 // db/database.js reads DB_PATH at require-time — set it BEFORE requiring.
 process.env.DB_PATH = dbPath;
-const { getDb, ensureUserDefaultCategories } = require('../../db/database');
+const { getDb, ensureUserDefaultCategories } = require('../../db/database.cts');
-const { seedDemoData } = require('../../scripts/seedDemoData');
+const { seedDemoData } = require('../../scripts/seedDemoData.cts');
 
 const db = getDb(); // initializes schema + runs migrations
 
 // Regular `user` (role 'user', no forced password change) — mirrors the app's
-// own INIT_REGULAR_USER seed path in server.js.
+// own INIT_REGULAR_USER seed path in server.cts.
 let user = db.prepare('SELECT id FROM users WHERE username = ?').get(E2E_USER);
 if (!user) {
   const hash = bcrypt.hashSync(E2E_PASS, 12);

playwright.config.js

@@ -73,7 +73,7 @@ module.exports = defineConfig({
   // `url` to respond before starting tests.
   webServer: [
     {
-      command: 'node server.js',
+      command: 'node server.cts',
       url: `http://localhost:${API_PORT}/api/version`,
       reuseExistingServer: false,
       timeout: 120_000,

scripts/prod-smoke.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Production-build smoke (QA_PLAN B15): builds the app, boots `node server.js`
+# Production-build smoke (QA_PLAN B15): builds the app, boots `node server.cts`
 # serving dist/ against a scratch DB, and drives the real artifact with Playwright
 # to confirm the split vendor chunks load and the app works in production.
 set -euo pipefail
@@ -15,7 +15,7 @@ echo "[prod-smoke] preparing scratch DB…"
 node e2e/setup/prepare-db.js >/dev/null 2>&1
 
 echo "[prod-smoke] starting production server on :${PORT}…"
-DB_PATH="db/e2e.db" PORT="${PORT}" BIND_HOST=127.0.0.1 node server.js >/tmp/prod-smoke-server.log 2>&1 &
+DB_PATH="db/e2e.db" PORT="${PORT}" BIND_HOST=127.0.0.1 node server.cts >/tmp/prod-smoke-server.log 2>&1 &
 SRV=$!
 trap 'kill "${SRV}" 2>/dev/null || true' EXIT
 

server.cts

@@ -231,7 +231,7 @@ async function main() {
   }
   
   const userCount = db.prepare('SELECT COUNT(*) AS count FROM users').get().count;
-  if (userCount === 0) await require('./setup/firstRun').run(db);
+  if (userCount === 0) await require('./setup/firstRun.cts').run(db);
 
   // [seed] Check for and create regular user if INIT_REGULAR_USER/INIT_REGULAR_PASS are set
   if (process.env.INIT_REGULAR_USER && process.env.INIT_REGULAR_PASS) {

setup/firstRun.cts

@@ -1,6 +1,6 @@
 const readline = require('readline');
 const bcrypt = require('bcryptjs');
-const { logAudit } = require('../services/auditService');
+const { logAudit } = require('../services/auditService.cts');
 
 function line(char = '─', len = 56) {
   return char.repeat(len);