ci: make typecheck a real blocking gate; bump actions to Node 24 majors

The previous `vue-tsc --noEmit` step was a no-op: the root tsconfig uses
`files: []` with project references, so without `--build` it checks zero files
and always passes. Switch to `vue-tsc --build` (new `yarn typecheck` script)
and make the job blocking.

Fix the one error this surfaced: UsageEventDocument extended mongoose.Document,
whose `model` method collides with the `model: string` field. Use the
recommended pattern — a plain attrs interface passed to the Schema/Model
generics (hydrated docs still expose Document methods). Typecheck is now clean.

Bump actions/checkout@v5 and actions/setup-node@v5 to silence the Node.js 20
runtime deprecation (forced to Node 24 from 2026-06-16).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -10,12 +10,12 @@ jobs:
     name: Test suite
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Enable Corepack
         run: corepack enable
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: 22
           cache: yarn
@@ -27,19 +27,15 @@ jobs:
         run: yarn test
 
   typecheck:
-    name: Typecheck (non-blocking)
+    name: Typecheck
     runs-on: ubuntu-latest
-    # TypeScript strict mode is currently disabled (see review QUAL-10). This job
-    # surfaces type errors without gating merges; promote it to a required check
-    # once the strict-mode cleanup lands.
-    continue-on-error: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Enable Corepack
         run: corepack enable
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: 22
           cache: yarn
@@ -47,5 +43,5 @@ jobs:
       - name: Install dependencies
         run: yarn install --immutable
 
-      - name: vue-tsc
-        run: yarn vue-tsc --noEmit
+      - name: Typecheck (vue-tsc --build)
+        run: yarn typecheck