Closes #310

Summary

@webjsdev/core shipped an index.d.ts + a types export condition, but @webjsdev/server shipped neither. So under strict + nodenext a TypeScript app's import { createRequestHandler, cors, cache, createAuth, rateLimit, sitemap, ... } from '@webjsdev/server' emitted TS7016 ("Could not find a declaration file for module"). That blocked the webjs typecheck-in-CI story (a fresh scaffold would fail on the server import) and left a core import untyped for every TS app.

This ships a hand-authored, types-only overlay (the runtime stays plain .js + JSDoc, zero runtime cost):

• packages/server/index.d.ts types every named export of index.js. The high-traffic public API is precisely typed from each source's JSDoc (createRequestHandler return shape, cache<T> preserving the wrapped signature + .invalidate(), cors/rateLimit returning Middleware, sitemap/sitemapIndex returning string, Session, the revalidate* family, the context helpers, the cache stores, createAuth/Credentials/Google/GitHub). It reuses core's PageProps/LayoutProps/RouteHandlerContext rather than redefining, and defines ActionResult<T> locally (core does not export it) matching the documented envelope. Lower-traffic internals get reasonable structural declarations, not blanket any.
• src/check.d.ts and src/testing.d.ts type the ./check and ./testing subpaths. index.d.ts re-exports the testing helpers via export * (they ship from both entry points) to avoid duplication.
• package.json: types-first export conditions for ., ./check, ./testing (nodenext requires types before default), the top-level types, and index.d.ts added to files.

Tests

• Type-fixture (test/types/): imports the documented surface and USES it at real signatures under strict + nodenext (matching the scaffold's tsconfig), so a wrong signature fails compile.
• TS7016 counterfactual: moves index.d.ts aside and asserts the bare import errors TS7016 with non-zero tsc, then restores it, proving the overlay is load-bearing. Before: tsc exit 2 (TS7016). After: exit 0.
• Drift guard: asserts the overlay's named exports exactly match index.js's runtime exports, so a future export added without a type is caught.
• Full suite: pass, 0 fail. The 4-app dogfood (blog e2e + website/docs/ui-website prod boot) confirms the exports edit did not break runtime resolution (all three subpaths still import() at runtime). The scaffold suite passes.

Review

3 type tests green. A self-review found 4 type-accuracy nits (the Session.data shape was confidently wrong, redisStore/SessionStorage.save imprecise, a drift-test filename typo), all fixed and re-verified clean.

Docs

packages/server/AGENTS.md (new type-overlay note), agent-docs/typescript.md (both runtime packages now ship a type overlay). I deliberately did NOT wire webjs typecheck into scaffold CI in this PR (a separate follow-up). This PR closes the declaration gap that blocked it.