fix(api): clear the six API-route TypeScript regressions the new gate landed red on

#11705 froze config/quality/api-typecheck-baseline.json days before it merged;
by then six diagnostics had regressed on release/v3.8.51, so the gate turned
every open PR red on arrival (api-route-typecheck run 33299099596):

- webhooks/[id]/test/route.ts: duplicate `import { getWebhook, recordWebhookDelivery }`
  left by the barrel migration (#12051) — a real defect, ESM rejects duplicate
  bindings at load time.
- providers/volcengine-plan/connect/**: `if (!x.ok)` / `if (!validation.success)`
  do not narrow discriminated unions without strictNullChecks (repo is
  strict:false) — compare `=== false` so `.error` type-checks.
- providers/route.ts: type the ["id","provider"] column projection instead of
  passing `unknown` into cleanupProviderModelsAfterConnectionDelete.
- tunnels/tailscale/install/route.ts: spread PublicSafeTunnelErrorBody into the
  Record<string, unknown> payload pushEvent expects.

Gate back to OK (289 errors, all frozen) and the 12 diagnostics that had
disappeared since the freeze are ratcheted out of the baseline (--update).

config/quality/api-typecheck-baseline.json

@@ -158,7 +158,7 @@
   "src/app/api/providers/route.ts": {
     "TS2352": 1,
     "TS2322": 2,
-    "TS2345": 4
+    "TS2345": 3
   },
   "src/app/api/providers/test-batch/route.ts": {
     "TS2345": 4
@@ -182,8 +182,7 @@
     "TS2739": 1
   },
   "src/app/api/providers/volcengine-plan/connect/route.ts": {
-    "TS2739": 1,
-    "TS2339": 1
+    "TS2739": 1
   },
   "src/app/api/radar/local-model-state/route.ts": {
     "TS2339": 4
@@ -256,15 +255,6 @@
     "TS2345": 1,
     "TS2322": 1
   },
-  "src/app/api/tunnels/cloudflared/route.ts": {
-    "TS2339": 1
-  },
-  "src/app/api/tunnels/ngrok/route.ts": {
-    "TS2339": 1
-  },
-  "src/app/api/tunnels/tailscale/routeUtils.ts": {
-    "TS2339": 1
-  },
   "src/app/api/usage/analytics/route.ts": {
     "TS2352": 15
   },
@@ -274,9 +264,6 @@
   "src/app/api/v1/batches/route.ts": {
     "TS2339": 1
   },
-  "src/app/api/v1/chatgpt-web/image/[id]/route.ts": {
-    "TS2345": 1
-  },
   "src/app/api/v1/classify/route.ts": {
     "TS2322": 1
   },
@@ -287,8 +274,8 @@
     "TS2339": 1
   },
   "src/app/api/v1/images/edits/route.ts": {
-    "TS2339": 21,
-    "TS2322": 5
+    "TS2339": 18,
+    "TS2322": 4
   },
   "src/app/api/v1/messages/count_tokens/route.ts": {
     "TS2339": 2,
@@ -356,12 +343,6 @@
   "src/lib/db/tierConfig.ts": {
     "TS2345": 2
   },
-  "src/lib/guardrails/videoBridgeHelpers.ts": {
-    "TS2488": 1,
-    "TS2365": 2,
-    "TS2322": 1,
-    "TS2345": 1
-  },
   "src/lib/monitoring/comboHealthAutopilot.ts": {
     "TS2305": 1,
     "TS2345": 1

src/app/api/providers/route.ts

@@ -503,7 +503,10 @@ export async function DELETE(request: Request) {
   try {
     const requestedIds = new Set(body.ids);
     const deletedConnections = (
-      await getProviderConnections({}, undefined, undefined, ["id", "provider"])
+      (await getProviderConnections({}, undefined, undefined, ["id", "provider"])) as Array<{
+        id: string;
+        provider: string;
+      }>
     ).filter((connection) => requestedIds.has(connection.id));
     const deleted = await deleteProviderConnections(body.ids);
 

src/app/api/providers/volcengine-plan/connect/[sessionId]/code/route.ts

@@ -24,7 +24,7 @@ export async function POST(
   // regardless of whether the session happens to exist, and answering 404 for
   // it (the previous behavior) hides the real cause.
   const validation = validateBody(volcenginePlanCodeSchema, raw);
-  if (!validation.success) {
+  if (validation.success === false) {
     return NextResponse.json(
       { success: false, error: formatValidationMessage(validation.error) },
       { status: 400 }

src/app/api/providers/volcengine-plan/connect/[sessionId]/identity/route.ts

@@ -21,7 +21,7 @@ export async function POST(
   const raw = await request.json().catch(() => ({}));
   // Validate BEFORE the session lookup — see the sibling code/route.ts note.
   const validation = validateBody(volcenginePlanIdentitySchema, raw);
-  if (!validation.success) {
+  if (validation.success === false) {
     return NextResponse.json(
       { success: false, error: formatValidationMessage(validation.error) },
       { status: 400 }

src/app/api/providers/volcengine-plan/connect/route.ts

@@ -11,7 +11,7 @@ export async function POST(request: Request): Promise<NextResponse> {
 
   const raw = await request.json().catch(() => ({}));
   const validation = validateBody(volcenginePlanConnectSchema, raw);
-  if (!validation.success) {
+  if (validation.success === false) {
     return NextResponse.json(
       { success: false, error: formatValidationMessage(validation.error) },
       { status: 400 }
@@ -26,7 +26,7 @@ export async function POST(request: Request): Promise<NextResponse> {
         "@omniroute/open-sse/services/volcengineConsoleAutoLogin.ts"
       );
       const started = await volcengineConsoleAutoLoginService.startLogin(phone, { timeout });
-      if (!started.ok) {
+      if (started.ok === false) {
         return NextResponse.json({ success: false, error: started.error }, { status: 400 });
       }
       return NextResponse.json({ success: true, session: started.session });

src/app/api/tunnels/tailscale/install/route.ts

@@ -32,14 +32,13 @@ export async function POST(request: Request) {
             status: await getTailscaleTunnelStatus(),
           });
         } catch (error) {
-          pushEvent(
-            "error",
-            toPublicSafeTunnelError(
+          pushEvent("error", {
+            ...toPublicSafeTunnelError(
               error,
               "Failed to install Tailscale.",
               "tunnels/tailscale/install POST"
-            )
-          );
+            ),
+          });
         } finally {
           controller.close();
         }

src/app/api/webhooks/[id]/test/route.ts

@@ -12,7 +12,6 @@ import { buildTelegramUrl, buildTelegramPayload } from "@/lib/webhooks/integrati
 import { buildDiscordPayload } from "@/lib/webhooks/integrations/discord";
 import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
 import { insertDelivery } from "@/lib/db/webhookDeliveries";
-import { getWebhook, recordWebhookDelivery } from "@/lib/db/webhooks";
 import { isPrivateHost, OutboundUrlGuardError } from "@/shared/network/outboundUrlGuard";
 import { parseAndValidateWebhookUrl } from "@/shared/network/outboundUrlGuardPolicy";
 import crypto from "crypto";