Fix API lint errors blocking CI

eslint has been failing on 11 no-explicit-any errors, which kept the
whole pipeline red — including the new publish job that waits on lint.

The casts all worked around missing types rather than unknown shapes:

- jwt: @fastify/jwt decorates the instance at runtime, so the namespace
  is not in FastifyInstance's type. Described the parts we call and cast
  through unknown once, in one place, instead of `as any` at five sites.
- permissions: FastifyInstance.db is declared by the db plugin; the cast
  was stale and hid the real type.
- paginate: the querystring schema already validates page/perPage, so
  the call sites now name that shape via PaginationQuery.

Also dropped an unused import and an unused binding whose call is kept
for its validation side effect.

No behaviour change: eslint and tsc are both clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

apps/api/src/lib/jwt.ts

@@ -14,8 +14,33 @@ export interface RefreshTokenPayload {
 const ACCESS_TOKEN_EXPIRY = '15m';
 const REFRESH_TOKEN_EXPIRY = '7d';
 
+type JwtSign = (payload: object, options?: { expiresIn?: string }) => string;
+type JwtVerify = (token: string) => unknown;
+
+/**
+ * The parts of the JWT decoration we actually call.
+ *
+ * @fastify/jwt decorates the instance at runtime and the refresh namespace is
+ * registered by our own auth plugin, so neither appears in FastifyInstance's
+ * type. Describing the shape here keeps the call sites type-checked instead of
+ * casting the instance to `any`, which switches checking off entirely.
+ */
+interface JwtDecoratedInstance {
+  jwt?: {
+    sign?: JwtSign;
+    verify?: JwtVerify;
+    refresh?: { sign?: JwtSign; verify?: JwtVerify };
+    jwtRefresh?: { sign?: JwtSign; verify?: JwtVerify };
+  };
+}
+
+/** The decorated JWT namespace, or undefined when the plugin is not loaded. */
+export function getJwt(app: FastifyInstance): JwtDecoratedInstance['jwt'] {
+  return (app as unknown as JwtDecoratedInstance).jwt;
+}
+
 export function signAccessToken(app: FastifyInstance, payload: AccessTokenPayload): string {
-  const signer = (app as any).jwt?.sign;
+  const signer = getJwt(app)?.sign;
   if (typeof signer !== 'function') {
     throw new Error('JWT signer is not configured');
   }
@@ -23,7 +48,8 @@ export function signAccessToken(app: FastifyInstance, payload: AccessTokenPayloa
 }
 
 export function signRefreshToken(app: FastifyInstance, payload: RefreshTokenPayload): string {
-  const signer = (app as any).jwt?.refresh?.sign ?? (app as any).jwt?.jwtRefresh?.sign;
+  const jwt = getJwt(app);
+  const signer = jwt?.refresh?.sign ?? jwt?.jwtRefresh?.sign;
   if (typeof signer !== 'function') {
     throw new Error('Refresh JWT signer is not configured');
   }
@@ -31,7 +57,8 @@ export function signRefreshToken(app: FastifyInstance, payload: RefreshTokenPayl
 }
 
 export function verifyRefreshToken(app: FastifyInstance, token: string): RefreshTokenPayload {
-  const verifier = (app as any).jwt?.refresh?.verify ?? (app as any).jwt?.jwtRefresh?.verify;
+  const jwt = getJwt(app);
+  const verifier = jwt?.refresh?.verify ?? jwt?.jwtRefresh?.verify;
   if (typeof verifier !== 'function') {
     throw new Error('Refresh JWT verifier is not configured');
   }