feat(server): add a real backend TypeScript build and enforce module boundaries

The backend had started to grow beyond what the frontend-only tooling setup could
support safely. We were still running server code directly from /server, linting
mainly the client, and relying on path assumptions such as "../.." that only
worked in the source layout. That created three problems:

- backend alias imports were hard to resolve consistently in the editor, ESLint,
  and the runtime
- server code had no enforced module boundary rules, so cross-module deep imports
  could bypass intended public entry points
- building the backend into a separate output directory would break repo-level
  lookups for package.json, .env, dist, and public assets because those paths
  were derived from source-only relative assumptions

This change makes the backend tooling explicit and runtime-safe.

A dedicated backend TypeScript config now lives in server/tsconfig.json, with
tsconfig.server.json reduced to a compatibility shim. This gives the language
service and backend tooling a canonical project rooted in /server while still
preserving top-level compatibility for any existing references. The backend alias
mapping now resolves relative to /server, which avoids colliding with the
frontend's "@/..." -> "src/*" mapping.

The package scripts were updated so development runs through tsx with the backend
tsconfig, build now produces a compiled backend in dist-server, and typecheck/lint
cover both client and server. A new build-server.mjs script runs TypeScript and
tsc-alias and cleans dist-server first, which prevents stale compiled files from
shadowing current source files after refactors.

To make the compiled backend behave the same as the source backend, runtime path
resolution was centralized in server/utils/runtime-paths.js. Instead of assuming
fixed relative paths from each module, server entry points now resolve the actual
app root and server root at runtime. That keeps package.json, .env, dist, public,
and default database paths stable whether code is executed from /server or from
/dist-server/server.

ESLint was expanded from a frontend-only setup into a backend-aware one. The
backend now uses import resolution tied to the backend tsconfig so aliased imports
resolve correctly in linting, import ordering matches the frontend style, and
unused/duplicate imports are surfaced consistently.

Most importantly, eslint-plugin-boundaries now enforces server module boundaries.
Files under server/modules can no longer import another module's internals
directly. Cross-module imports must go through that module's barrel file
(index.ts/index.js). boundaries/no-unknown was also enabled so alias-resolution
gaps cannot silently bypass the rule.

Together, these changes make the backend buildable, keep runtime path resolution
stable after compilation, align server tooling with the client where appropriate,
and enforce a stricter modular architecture for server code.

scripts/build-server.mjs

@@ -0,0 +1,61 @@
+import fs from 'node:fs';
+import fsPromises from 'node:fs/promises';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const SCRIPT_DIR = path.dirname(fileURLToPath(import.meta.url));
+const PROJECT_ROOT = path.resolve(SCRIPT_DIR, '..');
+const OUTPUT_DIR = path.join(PROJECT_ROOT, 'dist-server');
+const SERVER_TSCONFIG_PATH = 'server/tsconfig.json';
+
+function getPackageBinaryPath(packageName) {
+  const packageJsonPath = require.resolve(`${packageName}/package.json`);
+  const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
+  const binField = packageJson.bin;
+  const binaryRelativePath =
+    typeof binField === 'string'
+      ? binField
+      : binField?.[packageName] ?? Object.values(binField ?? {})[0];
+
+  if (!binaryRelativePath) {
+    throw new Error(`Could not find a runnable binary for ${packageName}.`);
+  }
+
+  return path.resolve(path.dirname(packageJsonPath), binaryRelativePath);
+}
+
+function runPackageBinary(packageName, args) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, [getPackageBinaryPath(packageName), ...args], {
+      cwd: PROJECT_ROOT,
+      stdio: 'inherit',
+      env: process.env,
+    });
+
+    child.on('error', reject);
+    child.on('close', (code) => {
+      if (code === 0) {
+        resolve();
+        return;
+      }
+
+      reject(new Error(`${packageName} exited with code ${code}.`));
+    });
+  });
+}
+
+async function main() {
+  // Clean first so removed server files do not linger in dist-server and shadow newer source changes.
+  await fsPromises.rm(OUTPUT_DIR, { recursive: true, force: true });
+
+  await runPackageBinary('typescript', ['-p', SERVER_TSCONFIG_PATH]);
+  await runPackageBinary('tsc-alias', ['-p', SERVER_TSCONFIG_PATH]);
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exit(1);
+});