style(plugin-kit): adopt the biome config its own plugins already use

The kit had NO biome config and no lint script, while every plugin repo that
consumes it has both. So its source quietly drifted — unused imports, unsorted
imports, formatting — with nothing to catch any of it. Running biome here for
the first time reported 20 findings across 8 files.

Adds `plugin-kit/biome.json` mirroring the plugin repos' (tab indent, double
quotes, recommended lint preset, organizeImports), a `check` script, and
`@biomejs/biome` pinned to the same `^2.5.2` the plugins pin — without that pin
`bunx biome` resolved 2.4.6, which rejects the 2.5 `rules.preset` key.

Two deliberate differences from the plugin repos' copy:

  * no `vcs.useIgnoreFile` — those are standalone repos with a .gitignore beside
    the config; plugin-kit is a directory inside this one, and biome errors with
    "couldn't find an ignore file". The `files.includes` exclusions cover it.
  * `!examples/**/dist` instead of `!ui/dist` — the kit has examples, not a UI.

`css.parser.tailwindDirectives` is carried over and is load-bearing: without it
biome cannot parse `@theme` in src/theme.css and reports three parse errors on
CSS that is perfectly valid Tailwind v4.

Everything here is formatter/import churn except two real findings, both fixed:

  * `Layer` (library/define.ts) and `Cause` (sync-engine.ts) were imported and
    never used;
  * test/spike-httpapi.test.ts read `(reg?.body as …).ui.secret` one line after
    `expect(reg).toBeDefined()`. The optional chain undoes the assertion: had
    `reg` been undefined the `.ui` access would throw a TypeError instead of
    failing the test readably. Now asserted to the type system too.

Wired into plugin-kit-publish.yml as a `Lint & format` step ahead of Typecheck,
so this cannot rot again.

Gates after: biome clean (42 files), tsc clean, 67/67 tests, build clean.

plugin-kit/test/spike-httpapi.test.ts

@@ -9,6 +9,8 @@
 //   3. The real servePluginUi server (loopback, per-boot bearer secret, __health) proxies
 //      into the HttpApi handler end-to-end.
 import { describe, expect, test } from "bun:test";
+import type { Punktfunk } from "@punktfunk/host";
+import { servePluginUi } from "@punktfunk/host";
 import { Effect, Layer, Schema } from "effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Path from "effect/Path";
@@ -19,8 +21,6 @@ import {
 	HttpApiEndpoint,
 	HttpApiGroup,
 } from "effect/unstable/httpapi";
-import { servePluginUi } from "@punktfunk/host";
-import type { Punktfunk } from "@punktfunk/host";
 
 const Pong = Schema.Struct({ ok: Schema.Boolean, source: Schema.String });
 const EchoIn = Schema.Struct({ msg: Schema.String });
@@ -90,8 +90,11 @@ describe("spike 1: HttpApi via toWebHandler on Bun", () => {
 
 	test("end-to-end behind servePluginUi (loopback + bearer secret)", async () => {
 		const { handler, dispose } = HttpRouter.toWebHandler(appLayer);
-		const registrations: Array<{ method: string; path: string; body: unknown }> =
-			[];
+		const registrations: Array<{
+			method: string;
+			path: string;
+			body: unknown;
+		}> = [];
 		// servePluginUi only touches pf.request — a recording stub is a faithful host.
 		const pf = {
 			request: async (method: string, path: string, body?: unknown) => {
@@ -116,15 +119,18 @@ describe("spike 1: HttpApi via toWebHandler on Bun", () => {
 				(r) => r.method === "PUT" && r.path === "/plugins/spike",
 			);
 			expect(reg).toBeDefined();
-			const secret = (reg?.body as { ui: { secret: string } }).ui.secret;
+			// Not `reg?.body`: the optional chain undoes the assertion above — if `reg` were
+			// undefined the `.ui` access would throw a TypeError instead of failing this test
+			// readably. The `expect` is what guarantees it, so assert it to the type system too.
+			if (!reg) throw new Error("registration not found");
+			const secret = (reg.body as { ui: { secret: string } }).ui.secret;
 			expect(secret.length).toBeGreaterThanOrEqual(16);
 			const auth = { authorization: `Bearer ${secret}` };
 
 			// Health endpoint is served by servePluginUi itself.
-			const health = await fetch(
-				`http://127.0.0.1:${ui.port}/__health`,
-				{ headers: auth },
-			);
+			const health = await fetch(`http://127.0.0.1:${ui.port}/__health`, {
+				headers: auth,
+			});
 			expect(health.status).toBe(200);
 
 			// HttpApi endpoint through the real server.