ci: make the strict typing gate actually run (#42)

r6 Medium: AC4 was measurable only on a developer's machine — no
workflow invoked mypy, so a typing regression in any of the six
allowlist modules reached dev unnoticed while the issue claimed
measurable backend quality. Coverage and lint had continuous gates;
typing had a text comparison of a committed list.

The backend job now runs mypy right after ruff, from the same pinned
dependency file (mypy==2.3.1 — an unpinned checker would redden on code
that never changed). The step derives its module list from the
pyproject.toml strict allowlist instead of duplicating it, because a
drifted duplicate is a green step checking the wrong modules, and it
refuses an empty list rather than passing silently.

Guarded twice: a contract test pins all three facts (pinned checker,
a step that really invokes it, list read from pyproject) and the new
typing-gate-stops-running mutant reddens when the invocation is
neutered.

User-Visible: no
Issue: #42

.github/workflows/validate.yml

@@ -786,6 +786,22 @@ jobs:
           pip list --format=columns | grep -Ei 'homeassistant|voluptuous|^pytest '
       - name: Линт бэкенда (ruff, узкий набор)
         run: python -m ruff check custom_components/houseplan
+      # #42: типизация была измеримой только локально — CI её не исполнял, и
+      # регрессия в любом из allowlist-модулей проходила молча. Список модулей
+      # берётся ИЗ pyproject.toml, а не дублируется здесь: разошедшийся дубль
+      # означал бы зелёный шаг, проверяющий не то. Пустой список — отказ.
+      - name: Типы бэкенда (mypy strict по allowlist)
+        run: |
+          modules=$(python -c "
+          import tomllib
+          cfg = tomllib.load(open('pyproject.toml', 'rb'))
+          for o in cfg['tool']['mypy'].get('overrides', []):
+              if o.get('strict'):
+                  print(' '.join('-p ' + m for m in o['module']))
+          ")
+          test -n "$modules" || { echo '::error::strict-allowlist в pyproject.toml пуст — проверять нечего'; exit 1; }
+          echo "mypy strict: $modules"
+          python -m mypy $modules
       # #42: защита от тихого скипа HA-harness — импорт и порог collect
       - name: HA-harness присутствует
         run: |