refactor: apply nuclear-review findings (boundary validation, cart types, dedup)

[arzafran]

What this does

Applies the findings from a whole-codebase maintainability review (/nuclear-review). It's all behaviour-preserving cleanup — no features change — but it removes a class of latent bugs: malformed responses from HubSpot, Mailchimp, and Shopify now fail with a clear error at the network boundary instead of crashing later as a confusing property-access error, and the Shopify cart stops making an extra API call on every quantity change.

No user-facing behaviour changes. The success paths (form submits, cart add/remove/update, product fetch) work exactly as before.

Summary

Boundary validation (refactor(integrations))

• New parseApiResponse(schema, json, context) helper in lib/utils/validation.ts; HubSpot, Mailchimp, and the Shopify GraphQL envelope are now zod-validated at the fetch boundary instead of (await res.json()) as T.
• Mailchimp: typed MailchimpErrorCode union replaces error-string sniffing; tag/note writes are explicitly best-effort (no longer flip the result to failure); upsertMember dedups the two subscribe paths.
• HubSpot: removed the dead hubspotType field and its orphaned typeSetter.
• Turnstile: one dev-mode bypass path instead of two (production validation unchanged).

Shopify cart (refactor(shopify) + perf(shopify))

• Named the post-reshape line item (CartLineItem), derived CartLine from it, made Cart.id required — removing 11 as casts the missing types forced, and guarding addCartItem against an undefined variant.
• removeItem/updateItemQuantity take the lineId the client already holds, dropping the redundant getCart round-trip per mutation (a fallback is kept for optimistic lines without a confirmed id).
• Synthetic "All" collection gets a stable updatedAt so it doesn't bust caches.

Scripts & utils (refactor(scripts) + refactor(utils))

• ast-transforms: one shared in-memory ts-morph Project per applyOpsToText instead of up to six.
• Removed a duplicate pascalCase, adopted the existing cancelGuard for clack prompts (dropping manual casts), and renamed the two divergent updatePackageJson functions.
• Dropped the animation.ts re-export barrel so each util has one canonical import path.

Reviewed but intentionally not changed

• Env-var allowlist vs blocklist (setup-project vs prepare-handoff): left separate. They diverge on purpose — setup preserves unknown custom vars (blocklist), handoff strips them (allowlist). Merging would break one guarantee.

Follow-up (out of scope, not a regression)

• HubSpot forms feed the raw HubSpot fieldType into <input type=...>, so a phone field renders <input type="phone"> (invalid → falls back to text). Pre-existing; fixing it is a HubSpot-type → HTML-input-type mapping decision worth its own change.

Test Plan

• bun run check green — biome (0 errors), tsgo --noEmit, 414 tests pass
• lefthook pre-commit (typecheck + biome) passed on every commit
• Manual: subscribe via a HubSpot/Mailchimp form; add/remove/change quantity in the Shopify cart