refactor: upgrade to TypeScript 7 and update ESLint configuration

[chenyme]

Summary

Upgrade the frontend compiler to the stable TypeScript 7.0.2 release.

Because Next.js 16.2 and the current typescript-eslint parser still depend on the legacy TypeScript Compiler API, isolate the existing ESLint toolchain in a private pnpm workspace using TypeScript 5.9. Application code continues to compile exclusively with TypeScript 7.

Add explicit TypeScript 7 checks before development and production builds, adapt Next.js compatibility handling, and update the Docker dependency layer for the new workspace structure.

Change type

• Bug fix
• Feature
• Documentation
• Refactor
• Configuration / deployment
• Security hardening
• Other

Affected areas

• Frontend / UI
• Backend / API
• Authentication / authorization
• Conversations / streaming
• Files / RAG / extraction
• Model routing / providers
• MCP / tools
• Billing / payments
• Admin console
• Deployment / Docker / configuration
• Documentation

Verification

• cd frontend && pnpm install --frozen-lockfile --offline
• cd frontend && pnpm typecheck
• cd frontend && pnpm lint
• cd frontend && pnpm build
• Started the development server and verified /admin/statistics returned HTTP 200
• docker build --target frontend-builder -t deeix-chat-frontend-ts7-check .
• git diff --check

Screenshots, API examples, or logs

Not applicable. This change does not alter user-facing UI or public APIs.

Configuration, migration, and compatibility notes

• Frontend TypeScript is pinned to 7.0.2.
• The removed baseUrl compiler option was deleted; existing @/* path aliases remain valid.
• ESLint retains the existing Next.js Core Web Vitals and React rules.
• ESLint runs in a private tooling workspace with TypeScript 5.9 until typescript-eslint supports TypeScript 7.
• predev and prebuild run the TypeScript 7 CLI before Next.js starts.
• The Next.js compatibility alias points to the same stable TypeScript 7.0.2 package; no preview compiler is installed.
• Docker now copies the pnpm workspace manifests before frozen dependency installation.
• No application runtime, API, database, or deployment migration is required.

Documentation

• Documentation is not needed for this change.
• Documentation was updated.
• Documentation still needs to be updated.

Security and privacy

• No secrets, tokens, credentials, local config, or personal data are included.
• User data access remains scoped by authenticated user context unless an admin-only path explicitly requires broader access.
• Security-sensitive behavior was reviewed, including authentication, authorization, provider routing, file processing, billing, and admin APIs where relevant.

Checklist

• I searched existing issues and pull requests.
• Changes are focused and do not include unrelated refactors.
• Tests or static verification were run where practical.
• User-facing behavior, deployment steps, API contracts, or configuration changes are documented.
• Generated artifacts are included only when this project explicitly requires them.
• Caches, build output, .pyc files, .env files, and local storage data are not committed.