[15/44] Enable TS strict mode in data-access

Description

Part of the strict-mode rollout epic #35932. Enable TypeScript strict mode for the data-access project.

• Dependency layer: 3 (0 = leaf library, 10 = top-level app)
• Internal dependents: 27 project(s) — the graph reports 27, not the 23 originally stated
• Rollout order: 15 / 44
• Note: Shared services hub - high leverage.

Note: the original acceptance criteria referenced typescript-strict-plugin, npx tsc-strict, and // @ts-strict-ignore. That approach was dropped by the epic — the plugin was never installed. The ACs below reflect the approach actually in force, documented in core-web/CLAUDE.md → TypeScript Strict Mode.

⚠️ The six flags are already present in this project's tsconfig.json — and inert. data-access has no build target, so its own tsconfig is never read, and its 27 dependents compile these sources under their own non-strict configs. 36 lib errors and 47 spec errors sit behind those flags with CI green. The work here is fixing them, not adding flags.

Acceptance Criteria

• The six strict flags are present in data-access's own tsconfig.json (already true — do not re-add):
  forceConsistentCasingInFileNames, strict, noImplicitOverride, noPropertyAccessFromIndexSignature, noImplicitReturns, noFallthroughCasesInSwitch.
• tsc -p libs/data-access/tsconfig.lib.json --noEmit reports 0 errors.
• tsc -p libs/data-access/tsconfig.spec.json --noEmit reports 0 errors.
• All errors resolved with explicit types — no new any. Genuinely nullable declarations are widened rather than silenced.
• @ts-expect-error with a // TODO(#35948): note only where unavoidable; never a blanket @ts-ignore.
• nx run data-access:lint and :test pass, with the test count unchanged.
• Blast radius verified: the 6 already-strict dependents are counted before and after, with zero new errors. Widening public types in this library can only surface errors there.
• Runtime behaviour of the widened services is guarded by the consumer suites (dotcms-ui, ui).
• The enforcement status is recorded — i.e. whether any CI gate actually verifies the strictness.

⚠️ nx run data-access:test does not type-check. tsconfig.spec.json sets isolatedModules: true, which puts ts-jest in transpile-only mode. Passing tests are not evidence of type-cleanliness here; tsc -p is the acceptance test.

Priority

Medium

Additional Context

One project in the bottom-up rollout tracked by epic #35932.

Start with core-web/CLAUDE.md's TypeScript Strict Mode guidance, then run tsc -p libs/data-access/tsconfig.lib.json --noEmit and tsc -p libs/data-access/tsconfig.spec.json --noEmit to inventory the errors. Resolve the reported library and spec errors without new any, verify nx run data-access:lint and :test, then check the six strict dependents and record the enforcement status.