ci: run the pipeline on 3.12, fix the gates it was hiding, and cover dev

[Chaddacus]

What this fixes

.github/workflows/ci.yml has never been green, and it never ran for PRs into dev.

The root cause is one line: the workflow pinned python-version: '3.9' while the
backend ships on Python 3.12 (backend/Dockerfile). On 3.9,
backend/tests/test_mcp_queries.py fails to import (PEP 604 X | None), so pytest
executed nothing and reported 31% coverage against the --cov-fail-under=60
gate. The typecheck job never got as far as a type error. Moving CI to the real
runtime exposed the checks that were hiding behind that failure, and this PR fixes
each of them in the source. No gate was lowered and nothing was suppressed.

Backend

change	why
python-version: '3.9' -> '3.12' in all three backend jobs	matches the runtime the code actually targets
mypy.ini python_version = 3.9 -> 3.12	at 3.9, mypy aborts inside site-packages (anyio/_core/_tasks.py uses match) with "errors prevented further checking" and never analyses a single project file. anyio is a transitive dep with no pin, so CI resolves the same version. Raising the target is not a loosening -- it is the only setting under which mypy checks apps/ at all, and it is stricter about the syntax the code really runs.
backend-typecheck gains DEBUG / SECRET_KEY env	the mypy_django_plugin imports config.settings, which raises ImproperlyConfigured: You must set a secure SECRET_KEY when DEBUG=False. This is the actual failure in run 28346913057 -- mypy produced no output at all. Same two values backend-test already uses.
FolderSerializer.parent moves into a get_fields() override	DRF's own Field.parent occupies that attribute name on the base class, so the declarative parent = UserScopedFolderField(...) reads to mypy as an override of an unrelated attribute ([assignment]). get_fields() is a public DRF extension point and produces the identical field map, so the user-scoped queryset (the IDOR guard) is unchanged.
VoiceNoteListSerializer.folder gets PrimaryKeyRelatedField[Folder]	[var-annotated]: a read_only=True related field has no queryset for the stubs to infer the element type from. Quoted so the subscript is never evaluated at runtime.

No # type: ignore was added anywhere.

Frontend

npm run build under CI=true turns eslint warnings into errors. There were 17,
not the 12 that npm run lint reports -- the lint script is
eslint src/**/*.{ts,tsx} run under sh, which has no globstar, so **
collapses to one directory level and files like
src/components/AudioRecorder/*.tsx are never linted. The build output is the
authoritative list. (The glob itself is left alone; it is out of scope for this PR
but worth a follow-up.)

Every warning is fixed in the code. No eslint-disable was added.

• Dead imports and bindings removed: DocumentTextIcon (Layout),
  MicrophoneIcon (LoginPage, RegisterPage), ExclamationTriangleIcon
  (MicrophonePermission), PerformanceIndicator plus its
  showPerformanceIndicator prop (RecorderControls -- the component was never
  rendered and no caller passes the prop), getPerformanceStatusColor
  (PerformanceIndicator), and four leftovers from the disabled performance manager
  in useAudioRecorder (enablePerformanceManagement binding,
  lastAudioLevelUpdate, getAudioAnalysisInterval, mediaRecorderOptions and
  the loop that filled it -- the MediaRecorder creation loop below already walks
  the same config list directly).

• jsx-a11y/anchor-is-valid x2 (RegisterPage): both anchors were href="#".
  The app has no /terms or /privacy route, so a Link would point nowhere and
  a <button> would have nothing to do. LoginPage already renders the same
  notice as plain text; RegisterPage now matches. Visible wording is unchanged.

• no-redeclare (speech.d.ts): SpeechRecognition was both an interface and
  a declare var. The constructor now has its own named type,
  SpeechRecognitionConstructor, used by the Window interface. Nothing referenced
  the bare global as a value -- AudioDebugPanel goes through
  window.SpeechRecognition -- so the type surface is preserved.

• PerformanceManager: the CPU-benchmark accumulator was written and never read,
  which is exactly what lets an engine delete the loop the benchmark is timing. It
  is now read after the loop. The unused getCurrentTier() call in
  downgradeQuality() is a pure classifier and was dropped.

• react-hooks/exhaustive-deps in useAudioRecorder (the interesting one):
  startRecording was missing state.recordingTime and updateAudioLevel.
  Neither could simply be added:

  • state.recordingTime increments every second while recording, so listing it
    would rebuild startRecording on every tick. It was only read for a
    console.error diagnostic, and the closure meant that diagnostic always logged
    0. It now reads recordingTimeRef.current, alongside the isRecordingRef /
    isPausedRef pattern the hook already uses. This fixes the diagnostic as well.
  • updateAudioLevel is declared below startRecording, so naming it in the
    dependency array would be a TDZ ReferenceError at render time. It is invoked
    through updateAudioLevelRef.current().

  With those two resolved the rule then reported mimeType, sampleRate and
  shouldEnableDebugLogging as unnecessary -- the first two reach the callback
  only via the memoised getEffective* getters, which are already dependencies,
  and the third is not read at all. Removed.

• react-hooks/exhaustive-deps in MicrophonePermission and
  RecorderControls: the mount-time permission probe is now a useCallback that
  the effect depends on. RecordPage.handlePermissionChange is not memoised, so
  depending on the prop directly would re-run the probe -> setState -> re-render
  -> new prop identity -> loop. The prop is read through a ref instead, which also
  means permissionStatus.onchange reports to the current handler rather than the
  one captured at mount. RecorderControls destructures the hook's stable
  checkMicrophonePermission rather than depending on a property access the rule
  cannot verify.

Triggers

on.push.branches and on.pull_request.branches were [main] only, so nothing on
the dev line was ever checked. Both are now [main, dev].

e2e

frontend/e2e/tests/production-sweep.spec.js drives https://clio.chadacus.dev and
registers real accounts on it. The chromium project declares no testMatch, so it
matched everything under testDir -- the e2e-test job would have run a
registration sweep against production as soon as the earlier jobs went green.
playwright.config.js now sets a top-level testIgnore for that spec, with a
comment. It is unconditional rather than gated on CI, so no environment variable
can turn it back on. The spec is not deleted. npx playwright test --list --project=chromium drops from 11 files to 10 (50 tests); the spec was never
executed locally.

Verification

Run locally against the exact CI commands, on a Python 3.12 venv
(uv pip install -r requirements.txt, plus ruff==0.1.9 as CI pins) and a
throwaway postgres:15 container.

$ ruff check .
ruff-exit=0

$ DEBUG=True SECRET_KEY=ci-test-secret-key mypy apps/ --ignore-missing-imports
Success: no issues found in 47 source files
mypy-exit=0

$ DEBUG=True SECRET_KEY=... DB_HOST=127.0.0.1 DB_PORT=5437 \
    pytest --cov=apps --cov-report=term-missing --cov-fail-under=60 -q
TOTAL                                            1400    227    84%
Required test coverage of 60% reached. Total coverage: 83.79%
pytest-exit=0

(pytest.ini already sets -q, so the CI invocation is effectively -qq and
suppresses the count line. The same suite run as
pytest -o addopts= -m "not live" --tb=short -q reports
139 passed, 6 deselected, 204 warnings in 6.80s.)

$ npm ci && npm run lint
lint-exit=0    (no output -- 0 problems; was "12 problems (0 errors, 12 warnings)")

$ npx eslint 'src/**/*.{ts,tsx}'      # recursive, the full set
exit=0         (0 problems)

$ CI=true npm run build
Compiled successfully.

File sizes after gzip:
  116.42 kB (-12 B)  build/static/js/main.d24b0881.js
  9.86 kB            build/static/css/main.3a1ac151.css
  1.78 kB            build/static/js/453.e78c7972.chunk.js
build-exit=0   (was "Failed to compile." with 17 eslint warnings-as-errors)

Verification on this PR

CI runs on this PR: pull_request resolves the workflow from the merge ref, so the trigger change applies to the PR itself. The checks on the PR head are the evidence for every job, including e2e-test.

Follow-ups landed after review: the health probe is exempt from the anonymous throttle (a liveness probe must never 429), THROTTLE_ANON_RATE is plumbed through docker-compose.yml and raised for the CI e2e job only, and the celery service waits for the backend so both containers do not race to create the shared media volume path.

[Chaddacus]

Additional fix pushed as 11e33b8.

frontend/e2e/tests/comprehensive-harness.spec.js:103 asserted an h1 of
"Record Voice Note". That string does not exist anywhere in frontend/src --
src/pages/RecordPage.tsx:168 renders <h1 ...>New Voice Note</h1> -- so the
assertion failed against a correct page and would have kept the e2e-test job
red once it became reachable. The assertion now matches the real heading; the
test is not deleted or skipped.

The two sibling assertions in the same block were checked against the source and
are correct as written: "Ready to record"
(src/components/AudioRecorder/RecorderControls.tsx:117) and the
"Recording Tips" h3 (src/pages/RecordPage.tsx:321). Both left unchanged.

frontend/e2e/tests/production-sweep.spec.js:49 carries the same stale
assertion. It is excluded from every automated run by the testIgnore added in
this PR, so it is left as is.

Verification: npx playwright test --list --project=chromium still resolves
Total: 50 tests in 10 files (the specs parse, and production-sweep stays
excluded). The e2e job itself still cannot be executed locally, so this removes a
known failure rather than proving the job green.