Fix ffbt CI, engines and webpack watch typing so rc.4 can build and publish

[endway]

Why

Follow-up to #224. That PR merged at its first commit, so master now has the webpack-dev-server v5 migration (wds ^5.2.6, typescript ^4.9.5, version 1.0.0-rc.4) without the two commits that make it build and publish. Master is currently in a state where:

• engines.node still claims >=12, but wds 5 requires >= 18.12.0 and open@10 requires >= 18
• Node CI still runs the [12.x, 14.x, 16.x] matrix — none of which can run this dependency tree
• npm-publish.yml still runs Node 14 with a plain npm i
• Compiler.watch() is dereferenced unguarded, which does not compile against current webpack 5

The publish workflow will fail as master stands. npm publish fires prepack → npm run build, which dies on:

src/services/webpack/runner/run-compile-watcher.ts(23,13): error TS18048: 'watcher' is possibly 'undefined'.

So rc.4 cannot be released until this lands.

What

Exactly the two commits missing from #224:

Move CI and engines to Node 18+ for webpack-dev-server v5

• engines.node: >=12 → >=18.12.0 (truthful for wds 5 / open 10)
• Node CI matrix: [12.x, 14.x, 16.x] → [18.x, 20.x, 22.x]
• Publish workflow: Node 14 → 22
• Both workflows install with --legacy-peer-deps, working around a pre-existing conflict unrelated to this work: the root pins tslint ^6.0.0 while tslint-config-airbnb@5.11.2 peer-requires tslint ^5.11.0. npm 6 ignored peer conflicts; npm ≥ 7 treats it as fatal, which is why npm i fails on every currently supported Node and why CI has been red on master. Untangling the TSLint stack properly deserves its own change.

Guard Compiler.watch() result, which is optional in current webpack 5

• Compiler.watch() is typed undefined | Watching in current webpack 5 (it was Watching in 5.75), so the cleanup callback needs watcher?.close(...).
• Pre-existing and not specific to the dev-server work — the file is byte-identical to master. It stayed hidden because this repo sets package-lock=false, so a fresh install drifts webpack from 5.75 to 5.110 inside the declared ^5.75.0, and because CI never got past npm i to reach the build.

Verification

Node CI green on this branch across the full new matrix:

Job	Result
build (18.x)	✅ success
build (20.x)	✅ success
build (22.x)	✅ success

Locally, with a fresh npm i --legacy-peer-deps (webpack 5.110.0, TypeScript 4.9.5): npm run build exit 0, npm run test:ci 2 suites / 19 tests passed.

Consumer smoke test (peo-frontend, via npm pack + tarball install): npm start boots the dev server on :9095 with no schema error, webpack compiles successfully, and middleware precedence holds — /dev-api/documents returns application/json and /api/v2/edit/setDates returns text/plain OK, i.e. handled by the app's own routes rather than swallowed by historyApiFallback.

After this merges

rc.4 can be released (create a GitHub release → npm-publish.yml publishes with secrets.NPM_AUTH_TOKEN). Consumers on wds 5 then need onBeforeSetupMiddleware → setupMiddlewares, as described in #224.

🤖 Generated with Claude Code