feat: task 1.3 vite dev proxy + tsconfig hardening

Same-origin dev proxy via Vite's server.proxy:
- /api/*       -> ${VITE_DEV_DIRECTUS_URL}/*   (Directus REST + GraphQL)
- /ws-business -> ws://.../websocket           (Directus business-plane WS)
- /ws-live     -> ${VITE_DEV_PROCESSOR_WS_URL} (Processor live WS, Phase 1.5)

WS proxy targets derive ws:// scheme from the http(s) Directus URL.
loadEnv reads VITE_DEV_* overrides; sensible localhost defaults.

tsconfig.app.json: noUncheckedIndexedAccess + noImplicitOverride.

.env.example documents the two override vars; .env.local is gitignored
via the existing *.local pattern.

README "Local dev" section: proxy table + override instructions + port
collision workaround.

Deviation: spec called for .env.dev.example/.env.dev.local but Vite's
dev mode is "development" not "dev", so mode-specific files would be
.env.development.* and Vite wouldn't auto-load .env.dev.local. Switched
to the standard Vite .env.example/.env.local convention. Documented in
the task's Done section.

Plus: backfill 1.2 commit SHA (9918418) in its Done section.

vite.config.ts

@@ -1,14 +1,49 @@
 import path from 'node:path';
-import { defineConfig } from 'vite';
+import { defineConfig, loadEnv } from 'vite';
 import react from '@vitejs/plugin-react';
 import tailwindcss from '@tailwindcss/vite';
 
 // https://vite.dev/config/
-export default defineConfig({
-  plugins: [react(), tailwindcss()],
-  resolve: {
-    alias: {
-      '@': path.resolve(__dirname, './src'),
+export default defineConfig(({ mode }) => {
+  const env = loadEnv(mode, process.cwd(), 'VITE_');
+  const directusUrl = env.VITE_DEV_DIRECTUS_URL ?? 'http://localhost:8055';
+  const processorWsUrl = env.VITE_DEV_PROCESSOR_WS_URL ?? 'ws://localhost:8081';
+  // The WS proxy target needs the ws:// scheme; derive from the http(s) URL.
+  const directusWsUrl = directusUrl.replace(/^http(s?):\/\//, 'ws$1://');
+
+  return {
+    plugins: [react(), tailwindcss()],
+    resolve: {
+      alias: {
+        '@': path.resolve(__dirname, './src'),
+      },
     },
-  },
+    server: {
+      port: 5173,
+      proxy: {
+        // Directus REST + GraphQL. Strip /api prefix; SPA hits relative URLs.
+        '/api': {
+          target: directusUrl,
+          changeOrigin: true,
+          rewrite: (p) => p.replace(/^\/api/, ''),
+        },
+        // Directus business-plane WebSocket. Strip /ws-business; rewrite to
+        // Directus's actual /websocket path.
+        '/ws-business': {
+          target: directusWsUrl,
+          ws: true,
+          changeOrigin: true,
+          rewrite: (p) => p.replace(/^\/ws-business/, '/websocket'),
+        },
+        // Processor live-position WebSocket. Strip /ws-live; Processor binds
+        // bare (no path prefix) per the Phase 1.5 task spec.
+        '/ws-live': {
+          target: processorWsUrl,
+          ws: true,
+          changeOrigin: true,
+          rewrite: (p) => p.replace(/^\/ws-live/, ''),
+        },
+      },
+    },
+  };
 });