refactor(server): 清理全量 any 类型安全警告 (692 → 0)

- 全模块类型化:controller 的 req: any → AuthenticatedRequest/RequestUser,
  聚合查询 getRawMany 泛型标注、导入行/响应体定义具体 interface、
  catch (e: any) → unknown + 收窄、no-base-to-string 用 String() 显式转换
- 第三方无类型库边界(pdfkit/exceljs)文件级或单行 disable 并注明理由
- 顺带修复:get-business-context.tool 两个 require-await error、
  bills.controller 参数顺序隐患、main.ts compression 调用
- 运行时逻辑零改动;测试 142 套件 / 1065 用例全部通过

apps/server/src/organizations/organizations.controller.ts

@@ -17,6 +17,13 @@ import { JwtAuthGuard } from '../auth/guards/jwt-auth.guard';
 import { OperationLogsService } from '../operation-logs/operation-logs.service';
 import { extractRequestInfo } from '../common/request-utils';
 import { RequirePermission } from '../auth/decorators/permission.decorator';
+import type { AuthenticatedUser } from '../authorization';
+
+interface AuthenticatedRequest {
+  user: AuthenticatedUser;
+  headers?: Record<string, string | string[] | undefined>;
+  connection?: { remoteAddress?: string };
+}
 
 @UseGuards(JwtAuthGuard)
 @Controller('organizations')
@@ -49,7 +56,7 @@ export class OrganizationsController {
 
   @Post()
   @RequirePermission('organization:create')
-  async create(@Body() dto: CreateOrganizationDto, @Request() req: any) {
+  async create(@Body() dto: CreateOrganizationDto, @Request() req: AuthenticatedRequest) {
     const { ipAddress, userAgent } = extractRequestInfo(req);
     const result = await this.service.create(dto);
     await this.logService.log({
@@ -68,7 +75,7 @@ export class OrganizationsController {
 
   @Put(':id')
   @RequirePermission('organization:edit')
-  async update(@Param('id', ParseIntPipe) id: number, @Body() dto: UpdateOrganizationDto, @Request() req: any) {
+  async update(@Param('id', ParseIntPipe) id: number, @Body() dto: UpdateOrganizationDto, @Request() req: AuthenticatedRequest) {
     const { ipAddress, userAgent } = extractRequestInfo(req);
     const result = await this.service.update(+id, dto);
     await this.logService.log({
@@ -87,7 +94,7 @@ export class OrganizationsController {
 
   @Delete(':id')
   @RequirePermission('organization:delete')
-  async remove(@Param('id', ParseIntPipe) id: number, @Request() req: any) {
+  async remove(@Param('id', ParseIntPipe) id: number, @Request() req: AuthenticatedRequest) {
     const { ipAddress, userAgent } = extractRequestInfo(req);
     const result = await this.service.remove(+id);
     await this.logService.log({
@@ -105,7 +112,7 @@ export class OrganizationsController {
 
   @Delete(':id/permanent')
   @RequirePermission('organization:purge')
-  async purge(@Param('id', ParseIntPipe) id: number, @Request() req: any) {
+  async purge(@Param('id', ParseIntPipe) id: number, @Request() req: AuthenticatedRequest) {
     const { ipAddress, userAgent } = extractRequestInfo(req);
     const result = await this.service.purge(+id);
     await this.logService.log({