refactor: enforce strict backend typing

Enable strict TypeScript and reject non-null and definite-assignment assertions. Declare externally populated DTO fields, preserve runtime validation, and narrow values at their owners.

Verified: backend verify (257 tests), unchanged OpenAPI, and 21 SQLite/HTTP tests on retry. The initial SQLite run had two timeouts; baseline HEAD passed 21 tests as well.

test/bank-cards.e2e-spec.ts

@@ -1,3 +1,4 @@
+import assert from 'node:assert/strict';
 import { INestApplication } from '@nestjs/common';
 import { JwtService } from '@nestjs/jwt';
 import { Test } from '@nestjs/testing';
@@ -333,7 +334,8 @@ describe('Manual bank cards configured HTTP and real SQLite', () => {
     expect((await getCard(own.id)).balance.value).toBe('1000');
   });
   it('renames default category without role loss; duplicates and stale rename conflict', async () => {
-    const category = (await categories()).find((c) => c.isDefault)!;
+    const category = (await categories()).find((c) => c.isDefault);
+    assert.ok(category);
     await auth('patch', '/categories/' + category.id)
       .send({ version: category.version, name: 'Остальное' })
       .expect(200);
@@ -474,7 +476,8 @@ describe('Manual bank cards configured HTTP and real SQLite', () => {
       'delete',
       `/operations/${expense.id}?version=${current.version}`,
     ).expect(409);
-    const category = (await categories()).find((c) => !c.isDefault)!;
+    const category = (await categories()).find((c) => !c.isDefault);
+    assert.ok(category);
     await auth('patch', '/operations/' + expense.id)
       .send({ version: current.version, categoryId: category.id })
       .expect(200);