fix: remove all `any` types from source code

Replace `catch (err: any)` with `unknown` + type-safe access,
and `(err as any).code` with intersection type cast.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/auth/oauth-pkce.ts

@@ -377,7 +377,7 @@ export async function pollDeviceToken(deviceCode: string): Promise<TokenResponse
   if (!resp.ok) {
     const data = JSON.parse(resp.body) as { error?: string; error_description?: string };
     const err = new Error(data.error_description || data.error || `Poll failed (${resp.status})`);
-    (err as any).code = data.error;
+    (err as Error & { code?: string }).code = data.error;
     throw err;
   }
 

src/routes/auth.ts

@@ -186,8 +186,8 @@ export function createAuthRoutes(
 
       console.log(`[Auth] Device code flow completed — account ${entryId} added`);
       return c.json({ success: true });
-    } catch (err: any) {
-      const code = err.code || "unknown";
+    } catch (err: unknown) {
+      const code = (err as { code?: string }).code || "unknown";
       if (code === "authorization_pending" || code === "slow_down") {
         return c.json({ pending: true, code });
       }