fix(web): resolve 9 svelte-check errors blocking CI (TASK-674) (#200)

svelte-check was reporting 9 errors on main, blocking the CI gate.
All fixed:

 1. EditCollectionModal: make `open` prop bindable ($bindable()). This
    unblocks `bind:open={editCollectionOpen}` in two call sites:
    - routes/[username]/[workspace]/[collection]/+page.svelte:1153
    - routes/[username]/[workspace]/[collection]/[slug]/+page.svelte:1101

 2. [slug]/+page.svelte: narrow `item` inside callback-bound expressions:
    - Line 684 (.find closure) now uses a local @const for the slug
      rather than re-reading item.parent_collection_slug inside the
      callback (TS cannot narrow across the closure).
    - Line 744 star toggle handler now short-circuits on item presence,
      so both `item.slug` and `item.id` are safe.

 3. auth/cli/[code]/+page.svelte: guard against `$page.params.code`
    being `undefined` in both onMount and handleApprove.

 4. console/settings/+page.svelte: add @types/qrcode dev dependency
    so the dynamic `import('qrcode')` calls have proper typings.

`cd web && npx svelte-check` now reports 0 errors (warnings were
out of scope — addressed separately in TASK-685). `go build/vet/test`
and `cd web && npm run build` are green.

Parent: PLAN-644.

web/package-lock.json

@@ -34,6 +34,7 @@
 				"@sveltejs/kit": "^2.57.1",
 				"@sveltejs/vite-plugin-svelte": "^6.2.4",
 				"@types/marked": "^5.0.2",
+				"@types/qrcode": "^1.5.6",
 				"marked": "^17.0.5",
 				"svelte": "^5.51.0",
 				"svelte-check": "^4.4.2",
@@ -1938,6 +1939,26 @@
 			"integrity": "sha512-RGdgjQUZba5p6QEFAVx2OGb8rQDL/cPRG7GiedRzMcJ1tYnUANBncjbSB1NRGwbvjcPeikRABz2nshyPk1bhWg==",
 			"license": "MIT"
 		},
+		"node_modules/@types/node": {
+			"version": "25.6.0",
+			"resolved": "https://registry.npmjs.org/@types/node/-/node-25.6.0.tgz",
+			"integrity": "sha512-+qIYRKdNYJwY3vRCZMdJbPLJAtGjQBudzZzdzwQYkEPQd+PJGixUL5QfvCLDaULoLv+RhT3LDkwEfKaAkgSmNQ==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"undici-types": "~7.19.0"
+			}
+		},
+		"node_modules/@types/qrcode": {
+			"version": "1.5.6",
+			"resolved": "https://registry.npmjs.org/@types/qrcode/-/qrcode-1.5.6.tgz",
+			"integrity": "sha512-te7NQcV2BOvdj2b1hCAHzAoMNuj65kNBMz0KBaxM6c3VGBOhU0dURQKOtH8CFNI/dsKkwlv32p26qYQTWoB5bw==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"@types/node": "*"
+			}
+		},
 		"node_modules/@types/trusted-types": {
 			"version": "2.0.7",
 			"resolved": "https://registry.npmjs.org/@types/trusted-types/-/trusted-types-2.0.7.tgz",
@@ -3957,6 +3978,13 @@
 			"integrity": "sha512-yDJTmhydvl5lJzBmy/hyOAA0d+aqCBuwl818haVdYCRrWV84o7YyeVm4QlVHStqNrrJSTb6jKuFAVqAFsr+K3Q==",
 			"license": "MIT"
 		},
+		"node_modules/undici-types": {
+			"version": "7.19.2",
+			"resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.19.2.tgz",
+			"integrity": "sha512-qYVnV5OEm2AW8cJMCpdV20CDyaN3g0AjDlOGf1OW4iaDEx8MwdtChUp4zu4H0VP3nDRF/8RKWH+IPp9uW0YGZg==",
+			"dev": true,
+			"license": "MIT"
+		},
 		"node_modules/uuid": {
 			"version": "11.1.0",
 			"resolved": "https://registry.npmjs.org/uuid/-/uuid-11.1.0.tgz",

web/package.json

@@ -18,6 +18,7 @@
 		"@sveltejs/kit": "^2.57.1",
 		"@sveltejs/vite-plugin-svelte": "^6.2.4",
 		"@types/marked": "^5.0.2",
+		"@types/qrcode": "^1.5.6",
 		"marked": "^17.0.5",
 		"svelte": "^5.51.0",
 		"svelte-check": "^4.4.2",

web/src/lib/components/collections/EditCollectionModal.svelte

@@ -31,7 +31,14 @@
 		onclose: () => void;
 	}
 
-	let { open, collection, wsSlug, initialSection, onupdated, onclose }: Props = $props();
+	let {
+		open = $bindable(),
+		collection,
+		wsSlug,
+		initialSection,
+		onupdated,
+		onclose
+	}: Props = $props();
 
 	let confirmArchive = $state(false);
 	let archiving = $state(false);

web/src/routes/[username]/[workspace]/[collection]/[slug]/+page.svelte

@@ -681,8 +681,9 @@
 				<a href="/{username}/{wsSlug}">Home</a>
 				<span class="sep">/</span>
 				{#if item.parent_collection_slug && item.parent_slug}
-					{@const parentColl = allCollections.find(c => c.slug === item.parent_collection_slug)}
-					<a href="/{username}/{wsSlug}/{item.parent_collection_slug}">{parentColl?.icon ?? ''} {parentColl?.name ?? item.parent_collection_slug}</a>
+					{@const parentCollSlug = item.parent_collection_slug}
+					{@const parentColl = allCollections.find(c => c.slug === parentCollSlug)}
+					<a href="/{username}/{wsSlug}/{parentCollSlug}">{parentColl?.icon ?? ''} {parentColl?.name ?? parentCollSlug}</a>
 					<span class="sep">/</span>
 					<a href="/{username}/{wsSlug}/{item.parent_collection_slug}/{item.parent_slug}">{item.parent_ref || item.parent_title}</a>
 					<span class="sep">/</span>
@@ -741,7 +742,7 @@
 			<button
 				class="action-btn star-btn"
 				class:starred={starredStore.isStarred(item.id)}
-				onclick={() => starredStore.toggle(wsSlug, item.slug, item.id)}
+				onclick={() => item && starredStore.toggle(wsSlug, item.slug, item.id)}
 				title={starredStore.isStarred(item.id) ? 'Unstar' : 'Star'}
 			>
 				{starredStore.isStarred(item.id) ? '★' : '☆'}

web/src/routes/auth/cli/[code]/+page.svelte

@@ -10,6 +10,11 @@
 
 	onMount(async () => {
 		const code = $page.params.code;
+		if (!code) {
+			status = 'error';
+			error = 'Missing CLI session code.';
+			return;
+		}
 
 		try {
 			const session = await api.auth.cli.getSession(code);
@@ -40,6 +45,10 @@
 
 	async function handleApprove() {
 		const code = $page.params.code;
+		if (!code) {
+			error = 'Missing CLI session code.';
+			return;
+		}
 		approving = true;
 		error = '';