Type two functions to what they read, removing nine assertions

Nine of the gate's findings were not assertions at all in spirit — they were
two function signatures narrower than their callers, paid for at every call
site.

`recomputeIndex0Stats` took a bare `Dict` while all five of its callers hold
a real `Index0`, so each one laundered it through `as unknown as Dict`. It
reads exactly three fields, so it now says so: a Pick over events,
checkpoints and heads. Any Index0 satisfies it, a partial one still does, and
the five casts are gone.

`exportBackup` took `Record<string, unknown>` and is genuinely called two
ways: with a live VaultIndex from three places in the CLI and API, and with a
round-tripped backup payload from the tests. It treats either as an opaque
JSON document to canonicalize and encrypt, so the signature now names both
shapes instead of making the majority caller pretend to be the minority one.

No type surgery and no behaviour change: the same values reach the same code,
they just no longer have to lie about what they are on the way in. 44 -> 35.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01Vtx94nXDmNgXEeThUZP4QN

js/packages/cli/src/api/routes.ts

@@ -745,7 +745,7 @@ export function registerRoutes(server: ApiServer, ctx: ApiContext): void {
       const vault = await readVault(ctx);
       const body = bodyObject(req);
       const encrypt = body["plaintext"] !== true;
-      const wrapper = await exportBackup(vault.index as unknown as Record<string, unknown>, {
+      const wrapper = await exportBackup(vault.index, {
         mnemonic,
         fingerprint: generateFingerprint(mnemonic),
         encrypt,

js/packages/cli/src/program.ts

@@ -2425,7 +2425,7 @@ export function buildProgram(io: ProgramIo = defaultIo): Command {
         existsSync(resolved) && statSync(resolved).isDirectory()
           ? join(resolved, defaultBackupFilename(fingerprint))
           : resolved;
-      const wrapper = await exportBackup(vault.index as Record<string, unknown>, {
+      const wrapper = await exportBackup(vault.index, {
         mnemonic: vault.mnemonic,
         fingerprint,
         encrypt: !o.plaintext,

js/packages/cli/src/tui/menus.ts

@@ -1505,7 +1505,7 @@ async function exportDatabase(s: Session): Promise<void> {
   } else if (!basename(dest).includes(".")) {
     dest = `${dest}${BACKUP_EXTENSION}`;
   }
-  const payload = await exportBackup(s.vault.index as unknown as Record<string, unknown>, {
+  const payload = await exportBackup(s.vault.index, {
     mnemonic: s.vault.mnemonic,
     fingerprint: s.fingerprint,
   });