ci: hold unused files, exports and dependencies to a knip baseline that only shrinks

Nothing looked for dead code: no knip, depcheck or ts-prune, noUnusedLocals
off. knip.jsonc configures knip over the client, server and shared workspaces
with their real entry points (main.tsx, index.ts and bootstrap, the MikroORM
config, the forked plugin host and its SDK surface, migrations and seeders
found by glob, the shared build entries with one per locale, the scripts,
the tests and the Playwright launcher). lint:knip (scripts/ci/knip-ratchet.mjs)
counts its findings per category and file against scripts/ci/knip-baseline.json,
which only shrinks and is built on the client's ratchet helpers. Today's 427
findings are frozen, among them unused server dependencies (nodemon,
@types/uuid, eslint-plugin-prettier, @mikro-orm/cli), the unused root unrun,
and imports of packages no package.json lists (leaflet.markercluster, geojson).
False positives are fixed in knip.jsonc with the reason. knip is a root
devDependency; the check runs in server-quality, the job that installs every
workspace, and knip.jsonc joins the code area of the change classifier.

.github/workflows/test.yml

@@ -355,6 +355,14 @@ jobs:
         # unknown, passthrough, any) in shared's request schemas.
         run: cd shared && npm run contracts:open
 
+      - name: Unused code and dependencies check
+        # knip (knip.jsonc) over client, server and shared: unused files,
+        # exports, types and dependencies per file may not rise above
+        # scripts/ci/knip-baseline.json (scripts/ci/knip-ratchet.mjs). Here
+        # rather than in client-quality because it needs every workspace's
+        # dependencies, which only this job installs.
+        run: npm run lint:knip
+
   client-quality:
     name: Client Types & Lint
     needs: changes