Migrate frontend to TypeScript with Deno-based tooling (#209)

* Migrate frontend to TypeScript with Deno-based tooling (#206)

Compiles assets/*.ts via sensiolabs/typescript-bundle (standalone SWC
binary) and adds Deno for formatting, linting, type-checking, and
tests, keeping the project's no-Node/npm approach intact. Wires all
four into CI, the Justfile, and the pre-commit hook.

* fix: build TypeScript assets before running PHPUnit in CI

The tests job ran bin/console sass:build but never typescript:build,
so var/typescript/ didn't exist and any page rendering the importmap
(e.g. backoffice/base.html.twig) errored during tests.

* test: add regression test for backoffice navbar-toggler dead target

Guards against the navbar-toggler button pointing at a collapse
target (#navbarSupportedContent) that isn't rendered for the current
user — the bug hit on the login page before #210 restructured the
nav to always render at least one item (the Releases link) regardless
of auth state.

* fix: stop hand-enumerating TS files for deno check

deno check assets/*.ts assets/controllers/*.ts assets/controllers/bo/*.ts
was duplicated in CI and the Justfile, and silently misses any new
controller subdirectory (fmt/lint/test already recurse assets/ via
deno.json). Add a top-level exclude for assets/vendor/ (respected by
all deno subcommands, unlike the per-task include/exclude blocks) so
deno check assets/ can recurse safely instead.

* fix: GitHubReleasesService date parsing and falsy release name

- Move the release-mapping array_map inside the try block so a
  malformed published_at (or any other parse failure) degrades to the
  same empty-list fallback as an HTTP failure, instead of throwing
  uncaught out of the cache callback.
- Stop treating a release literally named "0" as unnamed — the old
  `?:` fallback is falsy for that string and silently substituted the
  tag name instead.
- Render release dates in UTC explicitly; Twig's date filter otherwise
  silently converts to the app's default timezone (Europe/Amsterdam),
  which could show the wrong calendar day for releases near midnight.

* docs: add scope-creep-as-a-service rule to CLAUDE.md

Per user instruction: when a review turns up a real bug outside the
current task's scope, fix it in the same MR (with a regression test)
rather than just reporting it, unless it needs a human design call.

.githooks/pre-commit

@@ -12,7 +12,12 @@ while IFS= read -r file; do
     [[ -n "$file" ]] && STAGED_TWIG+=("$file")
 done < <(git diff --cached --name-only --diff-filter=ACMR | grep -E '\.twig$' || true)
 
-if [[ ${#STAGED_PHP[@]} -eq 0 && ${#STAGED_TWIG[@]} -eq 0 ]]; then
+STAGED_TS=()
+while IFS= read -r file; do
+    [[ -n "$file" ]] && STAGED_TS+=("$file")
+done < <(git diff --cached --name-only --diff-filter=ACMR | grep -E '\.ts$' || true)
+
+if [[ ${#STAGED_PHP[@]} -eq 0 && ${#STAGED_TWIG[@]} -eq 0 && ${#STAGED_TS[@]} -eq 0 ]]; then
     exit 0
 fi
 
@@ -46,3 +51,18 @@ if [[ ${#STAGED_TWIG[@]} -gt 0 ]]; then
     "${DOCKER_CMD[@]}" vendor/bin/twig-cs-fixer fix "${STAGED_TWIG[@]}"
     git add "${STAGED_TWIG[@]}"
 fi
+
+if [[ ${#STAGED_TS[@]} -gt 0 ]]; then
+    echo "TypeScript (${#STAGED_TS[@]} file(s)): Deno fmt → lint → check"
+
+    echo "  → Deno fmt"
+    "${DOCKER_CMD[@]}" deno fmt "${STAGED_TS[@]}"
+    git add "${STAGED_TS[@]}"
+
+    echo "  → Deno lint"
+    "${DOCKER_CMD[@]}" deno lint --fix "${STAGED_TS[@]}"
+    git add "${STAGED_TS[@]}"
+
+    echo "  → Deno check"
+    "${DOCKER_CMD[@]}" deno check "${STAGED_TS[@]}"
+fi