ci(server): strict type errors per file may only shrink

tsconfig.strict.json is the build config with strictNullChecks and
noImplicitAny on. lint:strict runs tsc over it and holds the errors per file
to scripts/strict-baseline.json (204 in 109 files today): a file may only
lose errors, a new file starts at none, and an entry above its count fails
until --update lowers it. An error outside any file or an unreadable tsc run
fails closed. It runs in the server job; the build itself stays on
strict: false.

.github/workflows/test.yml

@@ -228,6 +228,12 @@ jobs:
       - name: Typecheck
         run: cd server && npm run typecheck
 
+      - name: Strict type errors may only shrink
+        # tsconfig.strict.json is the build config plus strictNullChecks and
+        # noImplicitAny. Its errors per file are held to
+        # scripts/strict-baseline.json; a new file starts at none.
+        run: cd server && npm run lint:strict
+
       - name: Typecheck tests
         # tests/ is outside the build tsconfig, so a service that grows a
         # constructor parameter does not break its hand-wired call sites at