v0.40.2 — tech-debt batches 2 & 3 (shared primitives, lib/stats, scraper dedup, typed ESLint)

Tech-debt batches 2 + 3 of the June 2026 cleanup sweep (epic #161). All behavior-preserving; no feature/visual change. (Batch 2 was build/CI-only with no runtime delta, so it gets its first version label here alongside batch 3.)

Batch 3 — shared primitives + tests (#150/#151/#152):

• #150 — consolidated duplicated UI primitives: one Segmented, lib/chartTheme.ts, useDismissable, useIntervalPayload + IntervalWidgetBody, pure formatPeakReadout (hand-calc tested). Class/output strings byte-identical.
• #151 — extracted pure lib/stats.ts (median/mad/stdev) replacing ~4 dup median bodies; added missing hand-calc tests (parsePdf fallbacks, ymToLastYmd, interval grain edges). +52 tests (921→973).
• #152 — scraper dedup: one fillEmailAndPassword, typed the collect.ts GraphQL any cluster (collectRaw.ts, zero any left), shared GQL_URL_RE / lib/ngrid/dates.ts / errMessage.ts.

Batch 2 — tooling hardening (#149/#160):

• #149 — type-checked @typescript-eslint (no-floating-promises/no-misused-promises errors, no-explicit-any warn) scoped to src/lib/**; enforced by next build. Zero floating-promise errors in existing code.
• #160 — buildx GHA cache on test/smoke-boot, report-only coverage, Node-24 GitHub Actions bumps.

Verified: Docker test 65 files / 973 tests; production build green (lint+typecheck); /api/verify 50/50 green on staging's prod-seeded data; dashboard renders clean (33 chart surfaces, 0 console errors). No schema change.

⚠ #152's auth.ts login extraction is the live login path — to be confirmed against a real account on the next scheduled scrape.