Finish strict mode: the last 11 core-web projects, then flip tsconfig.base.json

Task

Bring the last 11 core-web projects onto the six strict-mode flags, then retire the workspace-level opt-out.

The strict-mode rollout (#35932) is complete for the 44 projects it tracks — dotcms-ui, the last one, landed in #36957. These 11 were never in that epic's scope: one is excluded on purpose, five were created after the epic was written, and five are one or two flags short.

Current state (measured at 72f10fe5ac)

The two projects missing only forceConsistentCasingInFileNames and the three missing strict are the cheapest wins and should go first.

Why tsconfig.base.json still has "strict": false

Deliberate, and documented in both #35932 and core-web/CLAUDE.md: the rollout never flips it globally, so each project opts in via its own tsconfig.json and each PR stays small.

But its meaning has changed. When the epic started, that false was the global policy. Now that 44 projects opt in, it only shields these 11. Once they are done, flipping the base to "strict": true makes the per-project "strict": true redundant and removes the last place where a new project can be created non-strict by default — which is how five of the eleven above came to exist.

Acceptance Criteria

• All six flags in each of the 10 in-scope projects' own tsconfig.json (not tsconfig.spec.json, not the base)
• Each project's tsconfig.lib.json and tsconfig.spec.json at 0 errors, verified by exit status
• A decision recorded for apps/mcp-server: bring it in, or document why it stays excluded
• tsconfig.base.json flipped to "strict": true once the above is green
• The now-redundant per-project "strict": true lines either removed or deliberately kept, with the choice noted
• nx run-many -t build test lint no worse than baseline

Watch out for

The measurement traps in core-web/CLAUDE.md → TypeScript Strict Mode all apply. The two most likely to bite here:

• libs/sdk/vue and libs/sdk/ai are Vite projects. Their builds use esbuild and skip type checking, so the build target is not the gate — use the inferred typecheck target.
• A duplicate key wins silently. Read the whole compilerOptions block after adding flags; two projects on this branch were closed as strict while a later "strict": false in the same object made them nothing of the kind.

Notes

Related: #35932 (rollout, complete), #36957 (final PR), #37120 (strictTemplates, separate gate).

Read core-web/CLAUDE.md's TypeScript Strict Mode guidance, then inspect each listed project's own tsconfig.json along with tsconfig.lib.json and tsconfig.spec.json. Start with the two casing-only projects and the three missing strict, checking compilerOptions for duplicate keys; use the inferred typecheck target for libs/sdk/vue and libs/sdk/ai. Done means the ten in-scope projects pass their checks, apps/mcp-server has a recorded decision, and nx run-many -t build test lint is no worse than baseline before updating tsconfig.base.json.