fix(site): wire Resend waitlist via astro:env, fix TS errors + deprecations

- Move secrets to Astro's typed astro:env/server (schema in astro.config.mjs);
  removes process.env usage and the 3 TS2580 "Cannot find name 'process'" errors
  without adding @types/node.
- Replace deprecated contacts.create({ audienceId }) with segments: [{ id }]
  (env var RESEND_AUDIENCE_ID -> RESEND_SEGMENT_ID).
- Check the { error } return on both Resend calls: contact add is best-effort
  (non-fatal); a failed confirmation send now returns 502 instead of a false 200.
- Type the waitlist fetch result in WaitlistForm.astro.
- Add @astrojs/check + typescript devDeps and an `npm run check` script.

Verified: npm run check (0 errors), npm run build, secret not inlined into the
build output, and a runtime smoke test of the validation/honeypot/GET paths.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

site/.env.example

@@ -6,8 +6,9 @@
 # Resend API key (https://resend.com/api-keys). Server-only — never PUBLIC_.
 RESEND_API_KEY=
 
-# Resend Audience to add waitlist contacts to (https://resend.com/audiences).
-RESEND_AUDIENCE_ID=
+# Resend Segment to add waitlist contacts to (https://resend.com/segments).
+# (Resend renamed "Audiences" → "Segments"; this is the Segment ID.)
+RESEND_SEGMENT_ID=
 
 # Optional: confirmation sender. Domain must be verified in Resend.
 # Defaults to "PCBJam <hello@pcbjam.com>".