Enable all no-unsafe-* ESLint rules in production source

Turns on all six previously-suppressed @typescript-eslint/no-unsafe-*
rules for the main plugin source (argument, assignment, call,
member-access, return, enum-comparison). Test files retain their
suppressions because they work with JSON.parse results and API responses
whose shapes are verified by assertions rather than the type system.

Changes required to satisfy the rules:

- enum-comparison: cast req.headers.accept to ContentTypes before
  comparing against enum members.
- return: imported CallToolResult from the MCP SDK to tighten the
  mcpHandler callback return type; used String() → typed filter in
  vaultOperations tag normalisation; cast Function.apply result in
  the Express send override.
- assignment: cast loadData() result to Partial<LocalRestApiSettings>;
  typed documentMap.frontmatter lookups as unknown; replaced
  (window as any).moment with window.moment backed by overload
  declarations added to declarations.d.ts; cast mcpServer.tool result
  at callsite.
- call: replaced the mcpServer: any field with a MinimalMcpServer
  structural interface exposing only the three methods actually used,
  avoiding the TypeScript heap OOM that the SDK's full ToolCallback
  generic was causing.
- argument: replaced all .bind(this) route registrations with
  void-wrapped arrow functions ((rq, rs) => { void this.method(rq, rs); })
  so Express receives a correctly typed RequestHandler rather than any;
  cast req.body as string | Buffer for writeFileContent; cast MCP args
  as Record<string, unknown>.
- member-access: typed the Express router layer callback parameter as
  { handle?: unknown } instead of any.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>