feat: task 1.3 vite dev proxy + tsconfig hardening

Same-origin dev proxy via Vite's server.proxy:
- /api/*       -> ${VITE_DEV_DIRECTUS_URL}/*   (Directus REST + GraphQL)
- /ws-business -> ws://.../websocket           (Directus business-plane WS)
- /ws-live     -> ${VITE_DEV_PROCESSOR_WS_URL} (Processor live WS, Phase 1.5)

WS proxy targets derive ws:// scheme from the http(s) Directus URL.
loadEnv reads VITE_DEV_* overrides; sensible localhost defaults.

tsconfig.app.json: noUncheckedIndexedAccess + noImplicitOverride.

.env.example documents the two override vars; .env.local is gitignored
via the existing *.local pattern.

README "Local dev" section: proxy table + override instructions + port
collision workaround.

Deviation: spec called for .env.dev.example/.env.dev.local but Vite's
dev mode is "development" not "dev", so mode-specific files would be
.env.development.* and Vite wouldn't auto-load .env.dev.local. Switched
to the standard Vite .env.example/.env.local convention. Documented in
the task's Done section.

Plus: backfill 1.2 commit SHA (9918418) in its Done section.

.planning/ROADMAP.md

@@ -50,8 +50,8 @@ These rules govern every task. Any deviation must be discussed and documented as
 | #    | Task                                                                                                         | Status | Landed in |
 | ---- | ------------------------------------------------------------------------------------------------------------ | ------ | --------- |
 | 1.1  | Project scaffold (Vite + React + TS)                                                                         | 🟩     | (manual)  |
-| 1.2  | [Stack rounding-out (Tailwind + shadcn/ui + deps + Prettier)](./phase-1-foundation/02-stack-rounding-out.md) | 🟩     | local (uncommitted) |
-| 1.3  | [Vite dev proxy + path aliases + tsconfig hardening](./phase-1-foundation/03-vite-dev-proxy.md)              | ⬜     | —         |
+| 1.2  | [Stack rounding-out (Tailwind + shadcn/ui + deps + Prettier)](./phase-1-foundation/02-stack-rounding-out.md) | 🟩     | `9918418` |
+| 1.3  | [Vite dev proxy + path aliases + tsconfig hardening](./phase-1-foundation/03-vite-dev-proxy.md)              | 🟩     | `PENDING_SHA` |
 | 1.4  | [Runtime config endpoint](./phase-1-foundation/04-runtime-config.md)                                         | ⬜     | —         |
 | 1.5  | [Directus auth client (cookie mode + refresh)](./phase-1-foundation/05-directus-auth-client.md)              | ⬜     | —         |
 | 1.6  | [Login page](./phase-1-foundation/06-login-page.md)                                                          | ⬜     | —         |

.planning/phase-1-foundation/02-stack-rounding-out.md

@@ -107,4 +107,4 @@ Stack rounded out: Tailwind 4 via `@tailwindcss/vite`, shadcn/ui (slate base / n
 
 **Smoke check:** `pnpm typecheck`, `pnpm lint`, `pnpm format:check`, `pnpm build` all green. `App.tsx` renders a Tailwind-styled centered card with a shadcn `Button` to prove the toolchain works end-to-end. Bundle: 222KB raw / 70KB gzipped.
 
-(Commit SHA pending — work landed locally, not yet committed.)
+Landed in `9918418`.

.planning/phase-1-foundation/03-vite-dev-proxy.md

@@ -132,4 +132,18 @@ One gotcha: the proxy's `target` for a WS route must use a `ws://` or `wss://` s
 
 ## Done
 
-(Filled in when the task lands.)
+`vite.config.ts` switched to the function form, reads env via `loadEnv(mode, process.cwd(), 'VITE_')`, exposes three proxy routes:
+
+- `/api/*` → `${VITE_DEV_DIRECTUS_URL}/*` (default `http://localhost:8055`), strips the `/api` prefix.
+- `/ws-business` → derived `ws://...` from the Directus URL, rewrites to `/websocket`.
+- `/ws-live` → `${VITE_DEV_PROCESSOR_WS_URL}` (default `ws://localhost:8081`), strips the `/ws-live` prefix.
+
+`tsconfig.app.json` gains `noUncheckedIndexedAccess: true` and `noImplicitOverride: true`. The `@/*` path alias was already set up in 1.2 (deviation noted there).
+
+`.env.example` (committed) documents the two proxy override env vars; `.env.local` (already gitignored via the existing `*.local` pattern) is the developer's actual values file. README "Local dev" section rewritten with the proxy table and override instructions.
+
+**Deviation from spec:** the spec called for `.env.dev.example` / `.env.dev.local` but Vite's mode for `pnpm dev` is `development` (not `dev`), so mode-specific files would be `.env.development.local` and Vite wouldn't auto-load `.env.dev.local` at all. Switched to the standard Vite convention `.env.example` (committed docs) + `.env.local` (auto-loaded in any mode, gitignored). Cleaner and matches Vite's actual behaviour.
+
+**Smoke check:** `pnpm typecheck`, `pnpm lint`, `pnpm format:check`, `pnpm build` all green. Stricter tsconfig didn't surface any existing issues (current code is small).
+
+Landed in `PENDING_SHA`.