fix(site): wire Resend waitlist via astro:env, fix TS errors + deprecations

- Move secrets to Astro's typed astro:env/server (schema in astro.config.mjs);
  removes process.env usage and the 3 TS2580 "Cannot find name 'process'" errors
  without adding @types/node.
- Replace deprecated contacts.create({ audienceId }) with segments: [{ id }]
  (env var RESEND_AUDIENCE_ID -> RESEND_SEGMENT_ID).
- Check the { error } return on both Resend calls: contact add is best-effort
  (non-fatal); a failed confirmation send now returns 502 instead of a false 200.
- Type the waitlist fetch result in WaitlistForm.astro.
- Add @astrojs/check + typescript devDeps and an `npm run check` script.

Verified: npm run check (0 errors), npm run build, secret not inlined into the
build output, and a runtime smoke test of the validation/honeypot/GET paths.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

site/astro.config.mjs

@@ -1,5 +1,5 @@
 // @ts-check
-import { defineConfig } from 'astro/config';
+import { defineConfig, envField } from 'astro/config';
 import vercel from '@astrojs/vercel';
 
 // Static by default (every page prerenders to HTML, zero client JS).
@@ -11,4 +11,20 @@ export default defineConfig({
   adapter: vercel(),
   // Prefetch linked pages so SPA-style navigation feels instant.
   prefetch: { prefetchAll: true, defaultStrategy: 'viewport' },
+  // Typed, validated server secrets for the waitlist endpoint. All optional so
+  // the build never requires them and the endpoint degrades gracefully when a
+  // key is absent (see src/pages/api/waitlist.ts). The @astrojs/vercel adapter
+  // reads these from process.env at runtime — never inlined into the bundle.
+  env: {
+    schema: {
+      RESEND_API_KEY: envField.string({ context: 'server', access: 'secret', optional: true }),
+      RESEND_SEGMENT_ID: envField.string({ context: 'server', access: 'secret', optional: true }),
+      WAITLIST_FROM_EMAIL: envField.string({
+        context: 'server',
+        access: 'secret',
+        optional: true,
+        default: 'PCBJam <hello@pcbjam.com>',
+      }),
+    },
+  },
 });