refactor(types): drop remaining as-any / ts-ignore in cross-cutting infra (#1989)

[ariskemper]

What

Closes the last weak-typing items from the #1989 audit (findings #2 weak typing + #6 @ts-ignore cluster). Pure type-level cleanup — no runtime behavior change.

Changes

src/utils/redis-client.ts — replace 3× Record<string, any> (and their deno-lint-ignore no-explicit-any directives) with a local RedisClientFactoryOptions interface describing the subset of @redis/client's createClient options we actually pass (url, socket.tls, password, username). The npm module is loaded via dynamic import() and is otherwise any, so the typed boundary lives on our side.

src/security/sandbox/project-worker.ts — drop the @ts-ignore on new Worker(...) by making ExtendedWorkerOptions an intersection with the DOM WorkerOptions (WorkerOptions & { deno?: { permissions } }), matching the pattern already used in deno-sandbox.ts. The value is now assignable to the Worker constructor without suppressing the whole line (Deno still reads the extra deno field at runtime).

Tests

Pure type changes — the typecheck is the gate. Existing project-worker.test.ts still passes (it constructs a real Worker), confirming the suppression removal is runtime-safe. No adjacent redis-client test exists; the runtime createClient call is unchanged.

Refs #1989