refactor(server): 清理全量 any 类型安全警告 (692 → 0)

- 全模块类型化:controller 的 req: any → AuthenticatedRequest/RequestUser,
  聚合查询 getRawMany 泛型标注、导入行/响应体定义具体 interface、
  catch (e: any) → unknown + 收窄、no-base-to-string 用 String() 显式转换
- 第三方无类型库边界(pdfkit/exceljs)文件级或单行 disable 并注明理由
- 顺带修复:get-business-context.tool 两个 require-await error、
  bills.controller 参数顺序隐患、main.ts compression 调用
- 运行时逻辑零改动;测试 142 套件 / 1065 用例全部通过

apps/server/src/expenses/expense-operations.service.ts

@@ -290,8 +290,10 @@ export class ExpenseOperationsService {
           skipped++;
           errors.push(`第${rowNum}行: ${row.roomNumber} 无有效金额`);
         }
-      } catch (e: any) {
-        errors.push(`第${rowNum}行: ${row.roomNumber} 导入失败 - ${e.message}`);
+      } catch (e: unknown) {
+        errors.push(
+          `第${rowNum}行: ${row.roomNumber} 导入失败 - ${e instanceof Error ? e.message : '未知错误'}`,
+        );
         skipped++;
       }
     }
@@ -404,8 +406,10 @@ export class ExpenseOperationsService {
         // 校验金额
         try {
           this.assertPositiveAmount(row.amount);
-        } catch (e: any) {
-          errors.push(`第${rowNum}行: ${row.studentName} ${e.message}`);
+        } catch (e: unknown) {
+          errors.push(
+            `第${rowNum}行: ${row.studentName} ${e instanceof Error ? e.message : '未知错误'}`,
+          );
           skipped++;
           continue;
         }
@@ -422,8 +426,10 @@ export class ExpenseOperationsService {
         );
 
         imported++;
-      } catch (e: any) {
-        errors.push(`第${rowNum}行: ${row.studentName} 导入失败 - ${e.message}`);
+      } catch (e: unknown) {
+        errors.push(
+          `第${rowNum}行: ${row.studentName} 导入失败 - ${e instanceof Error ? e.message : '未知错误'}`,
+        );
         skipped++;
       }
     }