chore: Clean up workspace dependencies and Turbo config (audit session 1)

[KiwiGaze]

Summary

Implements all 8 small-effort (S) findings from the monorepo audit remediation spec (007), covering Session 1 — Mechanical Fixes.

Changes

• P0-1: Add server-only as explicit dependency to 10 packages that relied on pnpm hoisting
• P1-3: Add VERCEL_ENV to root turbo.json globalEnv for cache correctness
• P1-4: Cache .tsbuildinfo in type-check outputs so incremental builds survive Turbo cache
• P1-5: Add NEXT_PUBLIC_MAX_FILE_SIZE to env.mjs client schema for validation
• P2-1: Fix ai-review manifest — add lint script, fix test to not use watch mode
• P2-2: Move react/react-dom from peerDependencies to dependencies in Chrome extension (apps don't need peerDeps)
• P2-4: Route lint:next through Turbo for cache benefits
• P2-5: Normalize test/test:run task consistency — add explicit dependsOn: [], remove test → test:run indirection in 3 packages

Verification

• Biome lint: 0 issues
• ESLint (web): passed
• Type-check (22 packages): all passed
• Tests (22 packages): all passed

Test plan

• pnpm lint:fix — no issues
• pnpm lint:next — now routed through Turbo, passed
• pnpm type-check:all — 22 packages passed
• pnpm test:run — 22 packages passed
• Verify turbo run build --dry shows VERCEL_ENV in env hash
• Verify second pnpm type-check:all run uses Turbo cache (.tsbuildinfo restored)

Summary by CodeRabbit

• Chores
  • Updated build tool scripts to use Turbo and Vitest directly for improved workflow efficiency.
  • Added "server-only" dependency across multiple packages for better runtime safety.
  • Updated test script configurations across packages.
  • Adjusted environment variable and build configuration settings.
  • Reorganized React dependencies in Chrome extension package.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

---

Walkthrough

This PR updates dependency declarations and build configuration across the monorepo. It adds "server-only" as a runtime dependency to multiple packages, restructures React dependencies in the chrome extension, introduces a new environment variable for the web app, standardizes test scripts to invoke Vitest directly, updates the root lint:next script to use Turbo, and refines Turbo configuration with additional environment variables and task outputs.

Changes

Cohort / File(s)	Summary
server-only Dependency Additions packages/api-client/package.json, packages/errors/package.json, packages/event/package.json, packages/inbox/package.json, packages/parsing/package.json, packages/serialization/package.json, packages/task/package.json, packages/task-group/package.json, packages/uploads/package.json, packages/user/package.json	Added "server-only" v0.0.1 as a runtime dependency across multiple packages with trailing comma adjustments for JSON formatting.
Test Script Standardization packages/task-group/package.json, packages/task-sync/package.json, packages/ui/package.json, tools/ai-review/package.json	Updated test scripts to invoke Vitest directly (e.g., "vitest run --passWithNoTests") instead of routing through pnpm wrapper.
Chrome Extension React Dependencies apps/chrome-extension/package.json	Moved react and react-dom from devDependencies to dependencies and removed the peerDependencies block.
Web App Configuration apps/web/env.mjs	Added NEXT_PUBLIC_MAX_FILE_SIZE as an optional string to the client environment schema and wired it to runtime environment.
Root and Build Configuration package.json, turbo.json, tools/ai-review/package.json	Updated root lint:next script to use Turbo instead of pnpm; added VERCEL_ENV to Turbo globalEnv; configured type-check outputs; added empty dependsOn to test task; added sideEffects and lint script to ai-review package.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

• feat: Add architecture revamp proposal and package boundary guardrails #117: Modifies chrome-extension package.json dependency declarations for react/react-dom peer/dev entries.
• refactor(turbo): Clean up task and script semantics #150: Switches lint task to run via Turbo with related turbo task semantics.
• refactor(turbo): Add missing build-time env vars to web app turbo config #151: Adds NEXT_PUBLIC_MAX_FILE_SIZE to web app environment configuration and Turbo build environment.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main changes: cleaning up workspace dependencies and Turbo configuration. It matches the comprehensive set of modifications across multiple package.json files and turbo.json.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Peer Dependency Consistency	✅ Passed	All modified packages in packages/* maintain consistent peer dependency declarations with no violations detected.
Api Contract Layer Conventions	✅ Passed	No Next.js API route handlers were created or modified; env.mjs changes don't affect API route code paths.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

• 📝 Generate docstrings (stacked PR)
• 📝 Generate docstrings (commit on current branch)

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch chore/monorepo-audit-session1-mechanical-fixes

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}