[blue219]

Brief summary

Migrate general backend helpers to strict TypeScript while preserving their CommonJS exports and runtime behavior.

Depends on #5665, which depends on #5664. Merge order: #5664, #5665, then this PR. Until the preceding PRs merge, GitHub's master-based diff includes their commits. Review only this batch.

Which issue is fixed?

No linked issue. This is the second application-code batch of the incremental backend TypeScript migration.

In-depth Description

• Type long timeouts, Sequelize query serialization, HTML entities and sanitization, notification event configuration, profiling, authentication rate limiting, and the general utility exports.
• Preserve timer cancellation, Symbol serialization, native conversion and error cases, mutable exports, recursive copy behavior, null title handling, profiler state, and rate-limiter configuration and responses.
• Add narrow UUID/XML boundary declarations and the sorting-prefix global declaration needed by this batch. Runtime dependencies, embedded library implementations, and lint rules are unchanged.
• Add compile-only type contracts and targeted compatibility coverage. The first commit only renames eight source files, all reporting R100. The second commit adds types and tests. No documentation, parsers, generators, query modules, or subsequent migration phases are included in this batch.

How have you tested this?

Validated on Node.js 24.22.0:

npm ci --no-audit --no-fund
npm run typecheck:server
npm run lint
npm run clean:server
npm run build:server
npx --no-install mocha dist-server/test/server/utils/longTimeout.test.js dist-server/test/server/utils/stringifySequeslizeQuery.test.js dist-server/test/server/utils/htmlSanitizer.test.js dist-server/test/server/utils/notifications.test.js dist-server/test/server/utils/profiler.test.js dist-server/test/server/utils/rateLimiterFactory.test.js dist-server/test/server/utils/index.test.js

All 40 targeted tests passed. The rate-limiter suite exercises real HTTP requests on an ephemeral localhost port, and timeout cases use fake timers. Native query-value string conversion is retained without weakening strict ESLint.

Verified git diff-tree --no-commit-id --name-status -r -M 4e4efcef reports eight R100 renames. A build-output check confirmed all 462 existing JavaScript output paths from master remain present. No additional functional manual testing is required for this batch; full unit and packaging/startup checks run in the existing fork CI.

CI passed on the same commit in the fork:

• Unit tests: lint, type checking, and all 416 tests passed.
• Integration test: client build, server compilation, binary packaging, startup, and HTTP availability passed.

Upstream workflows currently require maintainer approval before running.

Screenshots

Not applicable; no web client changes.

[nichwall]

Everything looks good to me. I ran typecheck:server, lint, build:server, build-linux, build-win-no-compress, and docker-amd64-local successfully on all 3 PRs in this series and started the dev server.

[blue219]

Everything looks good to me. I ran typecheck:server, lint, build:server, build-linux, build-win-no-compress, and docker-amd64-local successfully on all 3 PRs in this series and started the dev server.

Thanks for reviewing and testing all three PRs!

Would you prefer me to wait until these are merged, or should I continue submitting small, incremental PRs for the TypeScript migration?