Root tooling hygiene: husky v8 patterns, repo-wide phpcs on every commit, license mismatch, stale devDependencies

Problem

Root-level developer tooling has accumulated traps and cruft:

• husky v8 patterns: "prepare": "husky install" and the . "$(dirname -- "$0")/_/husky.sh" sourcing line in .husky/pre-commit were deprecated in husky v9. It works today (husky is pinned to ^8), but any future bump breaks the hooks silently. lint-staged (13.x) is two majors behind.
• lint-staged PHP entry lints the whole repo: "*.php": ["composer run lint"] ignores the staged filenames lint-staged passes — phpcs.xml declares <file>.</file>, so every PHP commit runs phpcs over the entire tree. Slow, and it fails commits on pre-existing issues unrelated to the change.
• License mismatch: the repo LICENSE is GPL-2.0, but root package.json declares "license": "ISC".
• Suspected-dead devDependencies: nodemon@^2, webpack-cli@^4 (alongside webpack 5), ts-loader, clean-webpack-plugin, webpack-node-externals, @babel/plugin-transform-class-static-block — no root script references any of them; they look like leftovers from a previous _bin build setup.
• Generated _app artifacts committed: _app/vite.config.js, _app/vite.config.d.ts (compiled from vite.config.ts) and _app/tsconfig.node.tsbuildinfo.

Proposed fix

1. Migrate to husky v9 conventions ("prepare": "husky", drop the _/husky.sh line) and bump lint-staged.
2. Point the lint-staged PHP entry at ./vendor/bin/phpcs --standard=phpcs.xml directly so the staged file paths it appends actually take effect (same review for the lint:js / lint-style entries).
3. Fix package.json license to GPL-2.0-or-later (check _app/package.json too).
4. Verify, then remove the suspected-dead devDependencies: grep _bin/ and _app/ for imports/usage first; remove only what nothing references.
5. Gitignore and delete the generated _app artifacts (keep vite.config.ts as the source of truth).

Deliberately omitted

• A prettier step for *.{json,md,yml} in lint-staged — the config exists but enforcing it now would leak reformat noise into unrelated PRs. Revisit separately if wanted.

Out of scope

• Workflow/CI changes (#148), _bin code cleanup (separate issue, coming).

Start with package.json, .husky/pre-commit, phpcs.xml, _app/package.json, and the repository's ignore rules. Verify suspected dependency usage in _bin/ and _app/ before removing anything, then check the staged-file lint entries and generated artifacts. Done means the proposed tooling, license, dependency, and artifact cleanup is applied without unrelated formatting changes.