Type src/ against API and database shapes, fixing implicit anys

Adds .d.ts declarations beside the untyped JS modules imported from
TS (api.js, navConfig.js, adminSchema.js, adminNav.js, src/data/*),
with shapes taken from the server routes and migrations. get/post/
patch/del now return unknown unless the caller names the response.

Fixes found along the way:
- website/email/instagram are bare strings from splitLinks, not Link
  objects; OrganizationDetail's website and email pills rendered with
  no href or label and now link correctly.
- The chapter map falls back to FALLBACK_COLOR for a region with no
  colour instead of painting its tiles black.

Adds defineSection() so each page manifest entry's props are checked
against its own Component.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/pages/admin/RequireRole.tsx

@@ -18,10 +18,10 @@
 
 import { Navigate, Outlet } from "react-router-dom";
 import { useAuth } from "../../lib/auth.tsx";
-import { atLeast } from "../../lib/roles.ts";
+import { atLeast, type Role } from "../../lib/roles.ts";
 import { ADMIN_HOME } from "./adminNav.js";
 
-export default function RequireRole({ role = "superadmin" }) {
+export default function RequireRole({ role = "superadmin" }: { role?: Role }) {
   const { user, loading } = useAuth();
 
   // RequireAuth is already showing its own placeholder above this.