feat(devex): add a typescript sdk package with a typed ledger client

[tiana-code]

E-09 DevEx #305 (F-09.3) - a TypeScript SDK package.

What

New sdk/typescript/, a hand-written typed fetch client over the REST API (isomorphic - node + browser via global fetch, zero runtime deps), mirroring the Kotlin SDK #304 and web/src/api/client.ts:

• FincoreClient({baseUrl, token?, fetch?}): listAccounts(page,size) -> Page, getAccount(id) -> Account.
• Bearer applied only when a token is set; id path segment encodeURIComponent'd; non-2xx -> FincoreError(status); injectable FetchFn for testability.
• Types (Account/Page/AccountType/AccountStatus) mirror web/src/api/types.ts exactly.
• package.json is private with NO publish script; a dedicated sdk-ts-ci.yml workflow (node 22) runs npm ci + typecheck + test + build only - nothing is pushed to a registry (§0-safe).

Hand-written over openapi-generator: no codegen toolchain, reviewable, clean-room. Scope is a minimal first surface; broader operations are a follow-up (pairs with #310).

Evidence (node v24 local)

npm run typecheck (covers src + test) clean; 4 vitest tests pass; npm run build emits src-only dist/*.d.ts.

Gate chain

• code-reviewer: APPROVED with 1 must-fix - typecheck excluded test/; APPLIED (split tsconfig.build.json for src-only emit, base config typechecks src+test). Enabling it caught real test type errors (untyped mock fetch), now fixed via a typed FetchFn contract. Two LOW advisories declined with reason (node 22 matches the web-ci convention; exports field is YAGNI for a private package).
• security-auditor (opus): PASS, zero must-fix - §0 no-publish confirmed at package + CI layers, no secrets (test bearer is a fake fixture), devDeps-only lockfile, encodeURIComponent blocks path injection, §5.3 clean, SPDX on all files.
• evaluator: PASS (0.90).

Closes #305