[25/44] Enable TS strict mode in template-builder

Description

Part of the strict-mode rollout epic #35932. Enable TypeScript strict mode for template-builder.

Acceptance Criteria

• The six strict flags are in the project's own tsconfig.json — not tsconfig.spec.json, not tsconfig.base.json (which stays "strict": false).
• tsc -p <root>/tsconfig.lib.json --noEmit reports 0 errors.
• tsc -p <root>/tsconfig.spec.json --noEmit reports 0 errors.
• No new any, and no non-null assertions left in production code — nullability is handled with guards.
• nx run <project>:lint back at its baseline.
• nx run <project>:test unchanged.

[!IMPORTANT]
typescript-strict-plugin / npx tsc-strict / @ts-strict-ignore are not used — that approach was dropped early in the epic. See core-web/CLAUDE.md → TypeScript Strict Mode. The original ACs have been corrected.

Measurement caveats

Six ways to get a green signal that verified nothing, all hit during this epic:

1. nx run <project>:test never type-checks — ts-jest runs transpile-only because every tsconfig.spec.json sets isolatedModules: true.
2. TS2688 (a types entry that is not installed) aborts before semantic checking.
3. TS6053 (a files entry pointing at a missing file) aborts the same way.
4. TS5101 / TS5107 (deprecated baseUrl / moduleResolution: node10) also abort.
5. tsc -p does not check templates. Only a build does.
6. Check moduleResolution: node10 cannot resolve the @dotcms/* subpath exports.

The rule: any TS5xxx, TS6xxx or TS2688 error is a configuration error — tsc never reached the code, so the count after it is meaningless.

Neither project has a build target, so tsc -p on both configs is the acceptance test.

Priority

Medium

Read core-web/CLAUDE.md's TypeScript Strict Mode guidance and inspect template-builder's own tsconfig.json alongside tsconfig.lib.json and tsconfig.spec.json. Run tsc -p /tsconfig.lib.json --noEmit and tsc -p /tsconfig.spec.json --noEmit, then check the project's lint and test targets. Done means both type checks have zero errors, strict flags are project-local, production code has no new any or non-null assertions, and lint and tests remain at baseline.