fix: resolve pre-existing tsc errors blocking the test gate

Two type errors (surfaced by `npm run test` / tsc --noEmit on a full
toolchain; the in-browser bundler does not run tsc, so they were latent):

- useCVMClient.ts: remove a malformed cast
  `spots as typeof spots & { tags; created_at }[]` feeding
  deduplicateByIdentity(). The intersection dropped pubkey/kind and broke
  the reassignment to `spots`. deduplicateAddressable() already returns
  the correct shape, so the cast was both wrong and unnecessary.

- queryPersister.ts: import PersistedClient / Persister from
  @tanstack/query-persist-client-core (their canonical source) instead of
  @tanstack/react-query-persist-client, whose `export *` re-export tsc
  won't resolve for named type imports. Added the core package (5.102.8,
  matching the pinned wrapper) as an explicit dependency.

Both are pre-existing issues on the branch, unrelated to the audit
remediation commits.

Co-authored-by: shakespeare.diy <assistant@shakespeare.diy>

package-lock.json

@@ -58,6 +58,7 @@
         "@scure/bip32": "^2.0.1",
         "@scure/bip39": "1.6.0",
         "@tanstack/query-core": "^5.102.8",
+        "@tanstack/query-persist-client-core": "^5.102.8",
         "@tanstack/react-query": "^5.56.2",
         "@tanstack/react-query-persist-client": "^5.102.8",
         "@unhead/addons": "^2.0.10",
@@ -3533,6 +3534,16 @@
         "type": "github"
       }
     },
+    "node_modules/@tanstack/query-persist-client-core": {
+      "version": "5.102.8",
+      "resolved": "https://registry.npmjs.org/@tanstack/query-persist-client-core/-/query-persist-client-core-5.102.8.tgz",
+      "integrity": "sha512-t3v4/D6ejo/BrPzM5gm/AT3c4CWPCxFa+0cIjAeHAeanGPG6rCjFS1hZnPZH/rf55qe3qYYgx5U6iBZMY1PQjA==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/tannerlinsley",
+        "type": "github"
+      }
+    },
     "node_modules/@tanstack/react-query": {
       "version": "5.75.1",
       "resolved": "https://registry.npmjs.org/@tanstack/react-query/-/react-query-5.75.1.tgz",

package.json

@@ -65,6 +65,7 @@
     "@scure/bip32": "^2.0.1",
     "@scure/bip39": "1.6.0",
     "@tanstack/query-core": "^5.102.8",
+    "@tanstack/query-persist-client-core": "^5.102.8",
     "@tanstack/react-query": "5.102.8",
     "@tanstack/react-query-persist-client": "5.102.8",
     "@unhead/addons": "^2.0.10",

src/hooks/useCVMClient.ts

@@ -362,7 +362,7 @@ export function useCVMClient() {
 
       // Collapse the same real-world spot re-posted under a different id/author
       // (coordinate dedupe above can't catch those). Keeps the freshest copy.
-      spots = deduplicateByIdentity(spots as typeof spots & { tags: string[][]; created_at: number }[]);
+      spots = deduplicateByIdentity(spots);
 
       if (params.difficulty && params.difficulty !== 'all') {
         spots = spots.filter(

src/lib/queryPersister.ts

@@ -27,10 +27,14 @@
  */
 
 import { get, set, del } from 'idb-keyval';
+// PersistedClient / Persister are defined in the persist-client CORE package.
+// The React wrapper (@tanstack/react-query-persist-client) only re-exports them
+// via `export *`, which tsc does not resolve for named *type* imports under
+// this project's config — import them from the canonical source instead.
 import type {
   PersistedClient,
   Persister,
-} from '@tanstack/react-query-persist-client';
+} from '@tanstack/query-persist-client-core';
 import type { Query } from '@tanstack/react-query';
 
 const IDB_KEY = 'skatespots:react-query-cache';