fix(types): replace structural DB types with Pick<PrismaClient> and remove Prisma boundary as any casts

Replace ~440 lines of hand-written structural DB client types across 7 lib files
with `Pick<PrismaClient, ...>` from @capakraken/db. This eliminates all `as any`
casts at Prisma boundaries (cron routes, allocation effects, vacation procedures)
and surfaces two pre-existing bugs:
- weekly-digest.ts: `db.allocation.count()` called non-existent model (fixed → demandRequirement)
- estimate-reminders.ts: `submittedAt` field doesn't exist on EstimateVersion (fixed → updatedAt)

Also adds root eslint.config.mjs so lint-staged can lint package files.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/web/src/app/api/cron/security-audit/route.ts

@@ -128,7 +128,7 @@ export async function GET(request: Request) {
           .join(", ");
 
         await createNotificationsForUsers({
-          db: prisma as any,
+          db: prisma,
           userIds: adminUsers.map((u) => u.id),
           type: "SYSTEM_ALERT",
           title: `Security Audit: ${highSeverity.length} high-severity finding(s)`,