chore(ci): wire knip workflow to fail on unused exports

Installs knip 6.14.1 as a devDependency, ships a curated knip.json
covering every Next.js App Router special file plus the worker / script
/ test entry points, and adds a workflow that runs on every push to
main and every PR targeting main.

The gate trips on:
- unused files (a new orphan module ships zero callers)
- unused dependencies (a production dep with no consumer left behind)
- unused devDependencies (same, in dev land)
- unlisted binaries (a package.json script reaches for a CLI without
  declaring it)

Unused-exports + unused-types stay informational this release because
the v1.4.40 W-GHOSTS sweep cleared 1 177 lines of dead code but the
historic exported-surface backlog still sits at ~ 487 exports + 52
types. Cleaning that incrementally avoids a single mega-PR risk.

Baseline carve-outs in knip.json:

ignore — three files W-GHOSTS missed in v1.4.40 (kept as known-zero
callers until a follow-up wave can verify they're safe to delete with
their dedicated test removed in the same commit):
- e2e/setup/test-helpers.ts (9-line barrel; future-multi-user hook)
- src/components/charts/compliance-line-chart.tsx (chart module only
  referenced by a touch-action contract test)
- src/lib/logging/index.ts (21-line barrel re-export)

ignoreDependencies — runtime / build-time deps loaded outside the
import graph:
- @hookform/resolvers, react-hook-form: dynamic + framework conv.
- @prisma/client: re-exported via src/generated/ (which is ignored)
- next-themes: ThemeProvider mounts via dynamic import
- @vitejs/plugin-react: vitest.config consumer
- shadcn, tailwindcss, tw-animate-css: build pipeline
- testcontainers: integration-test bootstrap
- @types/* : ambient typings

ignoreBinaries — invoked via shell from integration helpers or
declared via :
- docker, docker-compose, pg_isready (integration setup)
- tsx (the openapi:generate + openapi:check scripts run via npx tsx)

.github/workflows/knip.yml

@@ -0,0 +1,40 @@
+name: Knip
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  knip:
+    name: Dead-code gate
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+
+      - run: pnpm db:generate
+
+      # v1.4.40 W-INFRA — fail the build when knip surfaces a new dead
+      # module, an unused production dependency, an unused devDependency,
+      # or an unlisted binary. Unused exports + types are intentionally
+      # left informational while the existing surface is cleaned wave by
+      # wave (487 exports / 52 types on the v1.4.40 baseline). The
+      # baseline carve-outs live in `knip.json` under `ignore` +
+      # `ignoreDependencies` + `ignoreBinaries` with the rationale
+      # captured in `.planning/phase-W-INFRA-v1440-report.md`.
+      - run: pnpm knip --reporter compact --include files,dependencies,binaries,unlisted